import type { IncomingMessage, ServerResponse } from 'node:http';
/** v1.1.10 — paths that never require a web token. */
export declare const PUBLIC_EXACT_PATHS: Set<string>;
export declare const PUBLIC_PREFIX_PATHS: string[];
export declare function isPublicPath(pathname: string, _method: string): boolean;
export declare function isLoopbackPeer(req: IncomingMessage): boolean;
export declare function isEnvOff(name: string): boolean;
export declare function hasForwardedPeerHeaders(req: IncomingMessage): boolean;
export declare function isTrustedLoopbackPeer(req: IncomingMessage): boolean;
/** R13 A5 — track once-per-process whether the deprecated `?token=`
 *  URL fallback has been used, so we warn at most once per service
 *  lifetime instead of spamming the journal. Cleared by tests via
 *  re-importing the module fresh. */
export declare let _queryTokenWarned: boolean;
export declare function extractToken(req: IncomingMessage, url: URL): string | null;
export declare let _tokenModule: typeof import('../core/access-token.js') | null;
/** Bind the access-token module. Called by startWebServer after importing it. */
export declare function bindTokenModule(mod: typeof import('../core/access-token.js') | null): void;
export declare function verifyTokenSync(raw: string): string | null;
/** Returns true if the request is authenticated (or auth not required). */
export declare function checkAuth(req: IncomingMessage, res: ServerResponse, url: URL): boolean;
/** Resolve a stable actor string for audit-event rows. Mirrors checkAuth's
 *  identity model:
 *    - auth disabled → 'web:auth-off'
 *    - loopback peer (no auth needed) → 'web:loopback'
 *    - verified token → 'web:<tokenId>'
 *    - otherwise → 'web:unknown' (request should already have been rejected
 *      by checkAuth — this branch exists for defensive logging). */
export declare function getRequestActor(req: IncomingMessage): string;
/** Resolve whether the request's actor has admin role. Used to gate
 *  mutation + privileged-read endpoints so a stolen viewer-role token
 *  can't elevate to control plane (R13 A1).
 *
 *  Trust order:
 *    1. AGIM_WEB_AUTH=off  → admin (operator explicitly disabled auth)
 *    2. Trusted loopback    → admin (operator on the host)
 *    3. Bearer token        → token.role === 'admin'
 *    4. Otherwise           → not admin
 *
 *  Note: when no token has been created yet (pre-bootstrap), the
 *  trusted-loopback branch still grants admin so the CLI bootstrap flow
 *  works. Disable it with AGIM_TRUST_LOOPBACK=off. Reverse-proxied
 *  requests with Forwarded / X-Forwarded-* peer headers never qualify. */
export declare function isRequestAdmin(req: IncomingMessage): boolean;
/** Send 403 and return false when the actor isn't admin. Use as guard:
 *  `if (!requireAdmin(req, res)) return` */
export declare function requireAdmin(req: IncomingMessage, res: ServerResponse): boolean;
export declare const __webAuthForTesting: {
    isTrustedLoopbackPeer: typeof isTrustedLoopbackPeer;
    isRequestAdmin: typeof isRequestAdmin;
    isPublicPath: typeof isPublicPath;
    setTokenModule(mod: typeof import("../core/access-token.js") | null): void;
};
/** Build the cookie attribute string. When the request looks HTTPS
 *  (req.socket.encrypted OR x-forwarded-proto=https from a reverse
 *  proxy / cloudflared / nginx), include `Secure`. Without `Secure`,
 *  modern Chrome / Safari downgrade or REJECT cookies with
 *  `SameSite=Strict` on HTTPS pages, which manifests as "logged in
 *  works on the same tab once, but a refresh kicks back to /login"
 *  — the symptom the operator reported 2026-05-19.
 *  Also relax SameSite=Strict → Lax so following an external link
 *  back to the dashboard doesn't lose the session. */
export declare function buildAuthCookie(req: IncomingMessage, token: string | null, maxAgeSec: number): string;
export declare function handleAuthLogin(req: IncomingMessage, res: ServerResponse): Promise<void>;
export declare function handleAuthLogout(req: IncomingMessage, res: ServerResponse): void;
/** POST /api/auth/exchange-mobile — redeem a short-TTL QR exchange code
 *  for the underlying raw access token. Public (code is the capability).
 *  One-shot: second redeem → 401. */
export declare function handleAuthExchangeMobile(req: IncomingMessage, res: ServerResponse): Promise<void>;
//# sourceMappingURL=auth.d.ts.map