/**
 * Inbound gate for borrowed traffic.
 *
 * Transport-agnostic on purpose: it takes a header bag and returns a decision,
 * so the same gate covers the Anthropic, OpenAI and Codex route groups from one
 * place in the server bootstrap instead of being re-implemented per engine.
 *
 * **The refusal contract is the load-bearing part.** A borrower must be able to
 * tell "you are out of credit" from "the upstream throttled me". If both arrive
 * as a bare 429, the borrower's cooldown planner treats an exhausted grant as a
 * transient rate limit and retries a peer that will never serve it again this
 * week. Every refusal therefore carries `x-neurolink-grant-status` and
 * `x-neurolink-grant-reason`, and the borrower routes on those, not the status
 * code.
 *
 * @module proxy/shareGate
 */
import type { ProxyShareGateOutcome, ProxyShareGrant, ProxyShareRefusalReason, ProxyShareRefusalResponse } from "../types/index.js";
/** Dedicated header, so a share token never collides with a client credential. */
export declare const SHARE_TOKEN_HEADER = "x-neurolink-share-token";
export declare const GRANT_STATUS_HEADER = "x-neurolink-grant-status";
export declare const GRANT_REASON_HEADER = "x-neurolink-grant-reason";
export declare const GRANT_COINS_HEADER = "x-neurolink-grant-remaining-coins";
export declare const GRANT_PEER_HEADER = "x-neurolink-grant-peer";
/**
 * Pull a share token out of the request.
 *
 * `Authorization: Bearer` is accepted only when the value carries our token
 * prefix — a bare client forwarding its own Anthropic credential must never be
 * mistaken for a borrower, and a borrower must never have its token confused
 * with an upstream credential.
 */
export declare function extractShareToken(headers: Record<string, string | undefined>): string | undefined;
export declare function buildShareRefusal(reason: ProxyShareRefusalReason, options: {
    status: number;
    grant?: ProxyShareGrant;
    retryAfterSeconds?: number;
    message?: string;
}): ProxyShareRefusalResponse;
/**
 * Should an untokened request be refused?
 *
 * Off by default so a node's own client keeps working on loopback exactly as
 * before. It must be turned on before the listener is exposed — an exposed
 * listener without it hands the lender's subscription to anyone who can reach
 * the tunnel.
 */
export declare function isGrantRequiredByEnv(): boolean;
/**
 * Decide whether an inbound request may proceed.
 *
 * An admitted outcome owns a concurrency slot; the caller **must** call
 * `release()` when the request finishes, including on error and on client
 * disconnect, or the grant's concurrency ceiling leaks.
 */
export declare function admitInboundShareRequest(input: {
    headers: Record<string, string | undefined>;
    model?: string;
    /** Requested output ceiling, used only to size the pre-authorization. */
    maxTokens?: number;
    requireGrant?: boolean;
    coinBalanceLookup?: (grant: ProxyShareGrant) => Promise<number | undefined>;
    now?: number;
}): Promise<ProxyShareGateOutcome>;