/**
 * JWT access-token helpers for Databricks Apps.
 *
 * Parses bearer tokens and `x-forwarded-access-token` payloads to read
 * OAuth scopes and other claims from incoming HTTP requests.
 *
 * @module
 */
import { type HeaderLike } from "./http.ts";
/**
 * Header the Databricks Apps front door forwards the caller's OAuth (OBO) token
 * on - the default source for every helper here.
 *
 * Exported because it is a wire contract several packages branch on, not just a
 * default argument: `@dbx-tools/appkit`'s `identity` module decides whether a
 * request can use OBO auth at all by its presence, and `@dbx-tools/tunnel`
 * must know the name to strip inbound copies of it. One spelling, one place.
 */
export declare const ACCESS_TOKEN_HEADER = "x-forwarded-access-token";
/** Header the front door forwards the caller's user id on. */
export declare const USER_ID_HEADER = "x-forwarded-user";
/** Header the front door forwards the caller's email on. */
export declare const USER_EMAIL_HEADER = "x-forwarded-email";
/**
 * Decode the JWT payload from a bearer token string or request headers.
 *
 * When `input` is header-like, walks every value for `headerName` (default
 * `x-forwarded-access-token`) and merges claim keys left-to-right.
 */
export declare function getAccessTokenPayload(input: HeaderLike | string, headerName?: string | undefined): Record<string, unknown>;
/**
 * OAuth scopes from the access-token JWT on `input`.
 *
 * Defaults to the `x-forwarded-access-token` header, which Databricks Apps
 * forward from the browser session.
 */
export declare function getAccessTokenScopes(input: HeaderLike | string, headerName?: string): Iterable<string>;
/**
 * Return true when `scopes` contains any value from `allowed`.
 *
 * Accepts the raw {@link MASTRA_SCOPES_KEY} array stamped on
 * `RequestContext` as well as iterables from {@link getAccessTokenScopes}.
 */
export declare function includesAccessTokenScope(scopes: unknown, allowed: readonly string[]): boolean;