/**
 * Trim a raw token value; empty or whitespace-only → null. This is THE single
 * predicate for "token configured" — an empty `WIGOLO_API_TOKEN` counts as
 * unconfigured on both the bind gate and the request gate.
 */
export declare function normalizeToken(raw?: string | null): string | null;
/**
 * Resolve the configured API token. `WIGOLO_API_TOKEN` env wins; otherwise the
 * trimmed contents of the file at `WIGOLO_API_TOKEN_FILE` (the standard
 * docker/systemd secret pattern). A missing/unreadable file → null (fail
 * closed). One rule, test-pinned.
 */
export declare function resolveApiToken(): string | null;
/**
 * Whether a bind host is loopback. TRUE only for 127.0.0.0/8 dotted literals,
 * the IPv6 loopback forms (`::1`, `[::1]`, `0:0:0:0:0:0:0:1`), and the literal
 * `localhost`. Everything else — `0.0.0.0`, `::`, empty, any hostname, any
 * LAN/public IP — is non-loopback. No DNS resolution: unknown = non-loopback
 * (fail closed).
 */
export declare function isLoopbackBind(host: string): boolean;
export interface BindGateInput {
    host: string;
    token: string | null;
    allowUnauthenticated: boolean;
}
export type BindGateResult = {
    ok: true;
} | {
    ok: false;
    message: string;
};
/**
 * Bind-time fail-closed gate. A non-loopback bind with no configured token and
 * no explicit override refuses to start. The message names both the token env
 * var and the override so the operator can act.
 */
export declare function evaluateBindGate(input: BindGateInput): BindGateResult;
export interface AuthContext {
    /** The configured API token, or null (open mode). */
    token: string | null;
    /** Whether the daemon is bound to a loopback address. */
    bindIsLoopback: boolean;
    /** Whether the operator opted into open remote access. */
    allowUnauthenticated: boolean;
    /** The daemon's configured bind host, for the open-mode Host allowlist. */
    bindHost?: string;
}
export interface RequestAuthInput {
    hostHeader: string | undefined;
    originHeader: string | undefined;
    authHeader: string | undefined;
}
export type AuthResult = {
    allow: true;
} | {
    allow: false;
    status: 401 | 403;
    reason: string;
    hint?: string;
};
/**
 * Request-time auth gate, two modes:
 *   - Token mode (token configured): Bearer required (constant-time compare);
 *     Host allowlist SKIPPED, Origin ignored. Missing/wrong → 401.
 *   - Open mode (no token):
 *       - loopback bind: Host allowlist → Origin-reject → allow.
 *       - non-loopback + override: Host allowlist SKIPPED, Origin-reject KEPT.
 */
export declare function checkAuth(ctx: AuthContext, req: RequestAuthInput): AuthResult;
//# sourceMappingURL=auth.d.ts.map