import { t as Interceptor } from "../transport-DDEHAmW4.mjs";

//#region src/client/cf-access.d.ts
/**
 * Parse headers from the EMDASH_HEADERS env var.
 * Format: newline-separated "Name: Value" pairs.
 * Blank lines and malformed entries are silently skipped.
 */
declare function parseHeadersFromEnv(): Record<string, string>;
/**
 * Parse an array of "Name: Value" strings into a headers record.
 * Malformed entries are silently skipped. Later values override earlier ones.
 */
declare function parseHeaderStrings(headers: string[]): Record<string, string>;
/**
 * Collect all --header flag values from process.argv.
 *
 * citty doesn't support repeatable string args, so we parse argv directly.
 * Handles both `--header "Name: Value"` and `--header="Name: Value"`.
 */
declare function parseHeadersFromArgv(): string[];
/**
 * Resolve custom headers from all sources.
 * Priority: env var < CLI flags (later wins).
 */
declare function resolveCustomHeaders(): Record<string, string>;
/**
 * Creates a transport interceptor that injects custom headers on every request.
 */
declare function customHeadersInterceptor(headers: Record<string, string>): Interceptor;
/**
 * Creates a fetch wrapper that injects custom headers.
 * Used by the login command for raw fetch calls before the client is created.
 */
declare function createHeaderAwareFetch(headers: Record<string, string>): typeof fetch;
/**
 * Check whether a response (fetched with `redirect: "manual"`) is a
 * Cloudflare Access redirect.
 */
declare function isAccessRedirect(response: Response): boolean;
/**
 * Try to get a cached Cloudflare Access JWT via `cloudflared access token`.
 *
 * Returns the JWT string if cloudflared is installed and has a cached token.
 * Returns null if cloudflared is not installed or has no cached token.
 */
declare function getCachedAccessToken(appUrl: string): Promise<string | null>;
/**
 * Launch `cloudflared access login` for interactive browser-based auth.
 *
 * This opens a browser window for the user to authenticate with their IdP.
 * On success, cloudflared caches the JWT locally. Call `getCachedAccessToken`
 * afterwards to retrieve it.
 *
 * Returns true if the command succeeded, false otherwise.
 */
declare function runCloudflaredLogin(appUrl: string): Promise<boolean>;
//#endregion
export { createHeaderAwareFetch, customHeadersInterceptor, getCachedAccessToken, isAccessRedirect, parseHeaderStrings, parseHeadersFromArgv, parseHeadersFromEnv, resolveCustomHeaders, runCloudflaredLogin };
//# sourceMappingURL=cf-access.d.mts.map