/**
 * HTTP auth hardening: must-change-password + API-key read-only + agent token helper.
 */
import type { IncomingMessage } from 'node:http';
import type { AppContext } from '../app-context.js';
/**
 * Block APIs when authenticated user must change password.
 */
export declare function enforceMustChangePassword(ctx: AppContext, req: IncomingMessage, _method: string, pathname: string): void;
/**
 * When requireUserTotp / requireAdminTotp is on, block APIs until the user enrolls.
 */
export declare function enforceMustEnrollTotp(ctx: AppContext, req: IncomingMessage, _method: string, pathname: string): void;
/**
 * Block mutating methods for read-only API keys (`scope: read`).
 */
export declare function enforceApiKeyReadOnly(ctx: AppContext, req: IncomingMessage, method: string, pathname: string): void;
/**
 * Agent secret from `X-Ysk-Agent-Token` or `Authorization: Bearer ysk_agent_…`.
 */
export declare function getAgentToken(req: IncomingMessage): string | undefined;
//# sourceMappingURL=auth-guards.d.ts.map