import { type JWTPayload } from "jose";
import { type IdentityConfig, type ValidatedTokenIngress, type ValidatedTokenProvider } from "../identity/index.js";
import type { ManagedUser } from "./auth.js";
/**
 * Resolve the caller identity for the `validated_token` ingress mode: pick
 * the provider by token issuer, verify the token (JWKS / introspection), then
 * map its claims into the identity envelope. Fail-closed (401) throughout.
 *
 * OIDC discovery runs only for the selected provider, or for issuer matching
 * when no provider is identifiable from already-known config. A discovery
 * outage on an unrelated provider does not block authentication.
 */
export declare function resolveValidatedTokenUser(_cfg: IdentityConfig, ingress: ValidatedTokenIngress, request: Request): Promise<ManagedUser>;
/**
 * Select the provider for `token`, materializing OIDC discovery only when
 * needed. Prefer providers whose issuer is already known so a custom-domain
 * discovery outage cannot block unrelated auth.
 *
 * @param providers - Declared validated-token providers.
 * @param token - Bearer token from the request.
 * @returns The selected provider, with discovery applied when required.
 */
export declare function resolveProvider(providers: ValidatedTokenProvider[], token: string): Promise<ValidatedTokenProvider>;
/** Extract the bearer token from the `Authorization` header, or 401. */
export declare function bearerToken(request: Request): string;
/**
 * Select the provider that should verify `token`. A single-provider deployment
 * always uses its one entry. Otherwise: JWT tokens route by `iss`; opaque
 * tokens route to the sole `introspect` provider. Fail-closed when selection
 * is ambiguous (401).
 *
 * Callers that may need OIDC discovery should use {@link resolveProvider}.
 */
export declare function selectProvider(providers: ValidatedTokenProvider[], token: string): ValidatedTokenProvider;
/** Map verified token claims into the managed user envelope, per `provider.claims`. */
export declare function claimsToUser(provider: ValidatedTokenProvider, claims: JWTPayload): ManagedUser;
/**
 * Expand `${ENV_VAR}` references. Missing variables fail closed (500) so auth
 * misconfiguration is not mistaken for a bad caller token.
 */
export declare function expandEnv(value: string): string;
//# sourceMappingURL=validated-token.d.ts.map