/**
 * Anthropic API passthrough — shape detection and route allowlist.
 *
 * Passthrough lets a client point an Anthropic SDK at the gateway with
 * their existing `sk-ant-api*` key. The gateway forwards to Anthropic
 * using that key, with no gateway-side state created. Anthropic-shaped
 * routes live under the `/anthropic/v1/*` prefix (mirroring the path
 * convention used for `/google/v1beta/*`), and the allowlist below is
 * the authoritative source for which routes are forwarded.
 *
 * Two invariants keep this safe:
 *
 *   1. Shape-based mode selection (not lookup-miss). A key matching
 *      `sk-ant-api*` is *only* ever treated as a passthrough key — it
 *      is never compared against the local `api_keys` table. A key
 *      *not* matching that shape is *only* ever compared against the
 *      local table. The two key spaces don't overlap (gateway keys are
 *      `ck_*`), so there's no collision and no side channel that lets
 *      a caller probe "is this a valid gateway key".
 *
 *   2. Route allowlist. Even with a valid `sk-ant-api*` key, only
 *      routes that mirror Anthropic's API are forwarded. Gateway-only
 *      routes (api-keys, settings, metrics, tenants, upstream-keys,
 *      audit, license, traces, providers, models, batch, skills,
 *      whoami, memory) reject passthrough — otherwise an Anthropic-key
 *      holder could enumerate gateway state.
 *
 * `sk-ant-oat*` (OAuth tokens) intentionally do NOT match — the
 * existing anthropic-provider sync flow rejects them (see
 * `handlers/anthropic-compat/sessions.ts`), so we keep the same posture in passthrough.
 */
export declare function isAnthropicApiKey(key: string): boolean;
/**
 * Anthropic OAuth token shape. `sk-ant-oat*` issued by `claude setup-token`
 * for subscription-OAuth flows. Distinct from API keys: requires header
 * remapping (CLAUDE_CODE_OAUTH_TOKEN, not ANTHROPIC_API_KEY) and is rejected
 * by the gateway's anthropic-proxy provider for hosted execution.
 *
 * Centralised here so the five places that previously did
 * `value.startsWith("sk-ant-oat")` inline agree on the predicate.
 */
export declare function isAnthropicOAuthToken(value: string | null | undefined): boolean;
export declare function isPassthroughAllowedPath(pathname: string): boolean;
//# sourceMappingURL=passthrough.d.ts.map