import type { KeyObject } from 'node:crypto';
import type express from 'express';
import type { HandlerContext } from '@atproto/xrpc-server';
export declare class EntrywayRelayTokenError extends Error {
    readonly reason: string;
    /**
     * @param reason Why the token was refused, as a short code (such as jose's
     * error code) so that logging it reveals nothing of the token or the client.
     */
    constructor(reason: string, options?: ErrorOptions);
}
/**
 * Rate limit bypass for requests the entryway makes with its service JWT.
 * Routes authenticate requests before applying rate limits, so this relies on
 * the route having accepted the token rather than verifying it again.
 */
export declare const entrywayRateLimitBypass: ({ auth }: HandlerContext) => boolean;
/**
 * Attributes the user requests the entryway proxies to the users rather than
 * to the entryway, by the relay token it signs. The rate limiters key on
 * `req.ip`, and on methods the PDS proxies they run before anything
 * authenticates the request, so the token is verified here, ahead of the XRPC
 * router.
 */
export declare function entrywayAttribution(relayTokenOpts: EntrywayRelayTokenOptions): express.RequestHandler;
type EntrywayRelayTokenOptions = {
    entrywayDid: string;
    pdsDid: string;
    key: KeyObject;
};
/**
 * Verifies the relay token that the entryway attaches to the user requests it
 * proxies, and returns the client IP address it attests to, in canonical form.
 *
 * @throws {EntrywayRelayTokenError} if the token is not valid
 */
export declare function verifyEntrywayRelayToken(token: string, opts: EntrywayRelayTokenOptions): Promise<string>;
export {};
//# sourceMappingURL=entryway-attribution.d.ts.map