import type * as cf from "@cloudflare/workers-types";
import * as Effect from "effect/Effect";
import type { RuntimeContext } from "../../RuntimeContext.ts";
import type { Application, ApplicationProps } from "../Access/Application.ts";
/**
 * Protect this Worker with Cloudflare Access (`access` prop). Two forms:
 *
 * - a `Cloudflare.Access.Application` — enroll into a **shared**
 *   application (one policy set across several Workers). Note Access
 *   policies are application-wide: every Worker enrolled in the
 *   application is gated by the same policies.
 * - `{ policies, ... }` — a **dedicated** application owned by this
 *   Worker, created/updated/deleted with it. Access configuration
 *   (policies, session duration, IdPs) lives on applications, so
 *   per-Worker configuration means a per-Worker application — this form
 *   declares one for you, namespaced under the Worker (`<Worker>/Access`).
 *
 * Either way, enrolling pushes this Worker's `worker` destination (and a
 * `preview_worker` destination unless `previews: false`) onto the
 * application through its binding contract, so the application deploys
 * with — and converges on — the destinations of every enrolled Worker.
 * Removing the prop (or the Worker) un-enrolls it on the application's
 * next reconcile.
 */
export type WorkerAccessConfig = Application | WorkerAccessApplication;
/**
 * A dedicated Access application owned by this Worker — per-Worker
 * policies without declaring the application yourself.
 */
export interface WorkerAccessApplication {
    /**
     * Policies gating access to this Worker — inline bodies, reusable
     * `Cloudflare.Access.Policy` resources, or policy ids (see
     * `ApplicationProps["policies"]`).
     */
    policies: NonNullable<ApplicationProps["policies"]>;
    /** Display name for the application. Auto-generated when omitted. */
    name?: string;
    /** Session lifetime, e.g. `"24h"`. */
    sessionDuration?: string;
    /** Allowed identity-provider UUIDs. */
    allowedIdps?: string[];
    /** Skip the IdP picker when exactly one IdP is allowed. */
    autoRedirectToIdentity?: boolean;
    /** Show the application in the App Launcher dashboard. */
    appLauncherVisible?: boolean;
    /**
     * Also protect the Worker's version preview URLs.
     * @default true
     */
    previews?: boolean;
}
declare const WorkerAccessIdentityError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
    readonly _tag: "WorkerAccessIdentityError";
} & Readonly<A>;
export declare class WorkerAccessIdentityError extends WorkerAccessIdentityError_base<{
    message: string;
    cause?: unknown;
}> {
}
/**
 * The identity Cloudflare Access authenticated for the current request,
 * as resolved by `ctx.access.getIdentity()`. Field names follow the wire
 * format of Access's identity payload (snake_case); identity providers can
 * attach additional fields, captured by the index signature.
 */
export interface WorkerAccessIdentity {
    /** The user's email address, if the identity provider supplies one. */
    readonly email?: string;
    /** The user's display name. */
    readonly name?: string;
    /** The user's unique identifier. */
    readonly user_uuid?: string;
    /** The Cloudflare account id the Access organization belongs to. */
    readonly account_id?: string;
    /** Login timestamp (Unix epoch seconds). */
    readonly iat?: number;
    /** The user's IP address at authentication time. */
    readonly ip?: string;
    /** Authentication methods used (e.g. `"pwd"`). */
    readonly amr?: string[];
    /** Identity-provider information. */
    readonly idp?: {
        id: string;
        type: string;
    };
    /** Where the user authenticated from. */
    readonly geo?: {
        country: string;
    };
    /** Group memberships from the identity provider. */
    readonly groups?: Array<{
        id: string;
        name: string;
        email?: string;
    }>;
    /** Device posture check results, keyed by check id. */
    readonly devicePosture?: Record<string, unknown>;
    /** True when the user connected via Cloudflare WARP. */
    readonly is_warp?: boolean;
    /** True when the user is authenticated via Cloudflare Gateway. */
    readonly is_gateway?: boolean;
    /** Service-token client id, when authenticated via a service token. */
    readonly service_token_id?: string;
    /** True when the request authenticated with a service token. */
    readonly service_token_status?: boolean;
    readonly [key: string]: unknown;
}
/**
 * Effect-native view of the Cloudflare Access runtime API on the execution
 * context (`ctx.access`). Present only when the request was admitted by a
 * Cloudflare Access policy (see the `access` prop on `Cloudflare.Worker`),
 * or when simulated locally via the Worker's `dev.access` config.
 */
export interface WorkerExecutionContextAccess {
    /** The Access application audience (AUD) tag that admitted this request. */
    readonly aud: string;
    /**
     * Resolve the authenticated identity — email, name, groups, device
     * posture, etc. Resolves `undefined` when Access has no identity for the
     * request (e.g. some service-token flows).
     */
    getIdentity(): Effect.Effect<WorkerAccessIdentity | undefined, WorkerAccessIdentityError, RuntimeContext>;
}
/** The env key `dev.access` is lowered into by the local worker provider. */
export declare const DEV_ACCESS_ENV_KEY = "ALCHEMY_DEV_ACCESS";
/**
 * Resolve the current request's Access context: workerd's native
 * `ctx.access` when the request came through Cloudflare Access, the
 * `dev.access` simulation under `alchemy dev`, and `undefined` (an
 * unauthenticated request) otherwise. Backs the `access` member of the
 * per-event `WorkerExecutionContext`.
 */
export declare const resolveAccessContext: (ctx: cf.ExecutionContext, env: Record<string, unknown> | undefined) => WorkerExecutionContextAccess | undefined;
export {};
//# sourceMappingURL=WorkerAccess.d.ts.map