import type { Config } from '../config/schema.js';
export type TailscaleAuthHeaders = {
    forwardedFor?: string;
    forwardedProto?: string;
    forwardedHost?: string;
    tailscaleUserLogin?: string;
};
export declare function parseTailscaleAuthHeaders(headers: Record<string, string | undefined>): TailscaleAuthHeaders;
export declare function isTailscaleServeRequest(params: {
    remoteAddress?: string;
    headers: TailscaleAuthHeaders;
}): boolean;
export declare function shouldAllowTailscaleIdentityAuth(cfg: Config): boolean;
export declare function verifyTailscaleIdentity(params: {
    cfg: Config;
    remoteAddress?: string;
    headers: TailscaleAuthHeaders;
}): Promise<{
    ok: true;
    login: string;
} | {
    ok: false;
}>;
/** Static gateway console routes that may skip token when Tailscale identity is verified. */
export declare function isTailscaleUiBypassPath(path: string): boolean;