/** What the probe found. */
export type AccessProbeResult = 
/** No gate: an unauthenticated request reached this server. */
{
    kind: "open";
    status: number;
}
/** A gate answered instead of this server. `location` is the login redirect. */
 | {
    kind: "gated";
    status: number;
    location: string;
    serviceTokenAccepted?: boolean;
}
/** The probe could not tell. Never a warning — an unreachable public URL is a
 *  different problem with its own symptoms, and guessing would cry wolf. */
 | {
    kind: "unknown";
    reason: string;
};
export interface AccessServiceToken {
    clientId: string;
    clientSecret: string;
}
/**
 * One request to this server's own public URL, from outside its own process.
 *
 * `/healthz` deliberately: it needs no credential, so a non-200 says something
 * about the *path in front of* the server rather than about authorization.
 * `redirect: "manual"` because the answer IS the redirect — following it would
 * fetch a login page and lose the evidence.
 */
export declare function probeAccessGate(args: {
    publicUrl: string;
    serviceToken?: AccessServiceToken;
    fetchImpl?: typeof fetch;
    timeoutMs?: number;
}): Promise<AccessProbeResult>;
/**
 * The operator-facing sentence. Separate from the probe so a test can read the
 * words rather than assert on a shape, and so the wording can change without
 * touching the network code.
 */
export declare function describeAccessProbe(result: AccessProbeResult): string | null;
/**
 * The host of the login redirect, and nothing else.
 *
 * That URL carries a signed JWT in its query string — identity metadata about
 * the account and the request. The host (`<team>.cloudflareaccess.com`) is the
 * diagnostic an operator needs; the rest is not ours to write into a log file
 * that ends up attached to bug reports.
 */
export declare function safeHost(location: string | undefined): string | undefined;
//# sourceMappingURL=access-probe.d.ts.map