/**
 * The default {@link App.create.Options.identify} hook: verifies a Cloudflare
 * Access JWT in-worker, so a request sent directly to the worker URL (bypassing
 * the edge gate) still can't reach the admin routes (defense in depth).
 *
 * The only admin module that imports `jose`, keeping that dependency out of the
 * IdP-agnostic core. Self-hosters not on Access supply their own `identify`.
 */
import type * as App from './App.js';
/**
 * Builds an {@link App.create.Options.identify} hook that verifies the Cloudflare
 * Access JWT against the team-domain JWKS (fetched lazily, cached by `jose`). Any
 * verification failure resolves to `null` (deny) rather than throwing.
 *
 * Verifies the signature and issuer (the team domain). The audience (`aud`) is
 * not checked, so any token minted for any app in the team's org is accepted —
 * fine when everyone with org access is trusted.
 *
 * @example
 * ```ts
 * import { App, Access } from 'tapimo/admin'
 *
 * App.create({
 *   // ...
 *   identify: Access.cloudflareAccess({
 *     teamDomain: 'https://tempo.cloudflareaccess.com',
 *   }),
 * })
 * ```
 */
export declare function cloudflareAccess(options: cloudflareAccess.Options): (request: Request) => Promise<App.Identity | null>;
export declare namespace cloudflareAccess {
    /** Options for {@link cloudflareAccess}. */
    type Options = {
        /** Team domain (e.g. `https://<team>.cloudflareaccess.com`); the token issuer and JWKS host. */
        teamDomain: string;
    };
}
//# sourceMappingURL=Access.d.ts.map