export interface AccessJwtConfig {
    /** Full JWKS URL, e.g. https://<team>.cloudflareaccess.com/cdn-cgi/access/certs */
    jwksUrl: string;
    /** Access application AUD tag the token's `aud` claim must contain. */
    audience: string;
    /** Expected token issuer, e.g. https://<team>.cloudflareaccess.com */
    issuer: string;
}
/** Verifies a Cloudflare Access assertion JWT. Resolves true iff signature + aud + iss + exp pass. */
export type AccessJwtVerifier = (token: string) => Promise<boolean>;
/**
 * Build a verifier bound to one Access team-domain JWKS + aud + iss. The remote JWKS is fetched
 * lazily on first use and cached (kid-indexed) by jose. Any verification failure — bad signature,
 * wrong aud/iss, expired, malformed token, unreachable JWKS — resolves false (never throws through),
 * so the caller can treat it as a plain allow/deny.
 */
export declare function createAccessJwtVerifier(cfg: AccessJwtConfig): AccessJwtVerifier;
/**
 * Construct an Access JWT verifier from env, or undefined when Access is not configured.
 *
 *   CORTEX_ACCESS_TEAM_DOMAIN  bare team name (`myteam`) or full host (`myteam.cloudflareaccess.com`)
 *   CORTEX_ACCESS_AUD          the Access application AUD tag
 *   CORTEX_ACCESS_CERTS_URL    (optional) overrides the derived JWKS URL
 *
 * Returning undefined when team-domain OR aud is absent is the secure-degrade path: the auth gate
 * keeps only the x-cortex-token route rather than admitting requests on an unconfigured Access app.
 */
export declare function accessVerifierFromEnv(env: NodeJS.ProcessEnv): AccessJwtVerifier | undefined;