import * as jose from 'jose';
import type { Chain } from 'viem';
import * as z from 'zod/mini';
import type * as Auth from './Auth.js';
declare namespace schema {
    const Token: z.ZodMiniObject<{
        header: z.ZodMiniObject<{
            alg: z.ZodMiniOptional<z.ZodMiniString<string>>;
            kid: z.ZodMiniOptional<z.ZodMiniString<string>>;
            typ: z.ZodMiniOptional<z.ZodMiniString<string>>;
        }, z.core.$strip>;
        payload: z.ZodMiniObject<{
            aud: z.ZodMiniOptional<z.ZodMiniUnion<readonly [z.ZodMiniString<string>, z.ZodMiniReadonly<z.ZodMiniArray<z.ZodMiniString<string>>>]>>;
            environment: z.ZodMiniOptional<z.ZodMiniString<string>>;
            exp: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
            iat: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
            iss: z.ZodMiniOptional<z.ZodMiniString<string>>;
            nbf: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
            owner: z.ZodMiniOptional<z.ZodMiniString<string>>;
            owner_id: z.ZodMiniOptional<z.ZodMiniString<string>>;
            project: z.ZodMiniOptional<z.ZodMiniString<string>>;
            project_id: z.ZodMiniOptional<z.ZodMiniString<string>>;
            sub: z.ZodMiniOptional<z.ZodMiniString<string>>;
            user_id: z.ZodMiniOptional<z.ZodMiniString<string>>;
        }, z.core.$strip>;
    }, z.core.$strip>;
    const Options: z.ZodMiniObject<{
        enforce: z.ZodMiniDefault<z.ZodMiniBoolean<boolean>>;
        environments: z.ZodMiniReadonly<z.ZodMiniArray<z.ZodMiniEnum<{
            development: "development";
            preview: "preview";
            production: "production";
        }>>>;
        issuer: z.ZodMiniURL;
        orgIds: z.ZodMiniReadonly<z.ZodMiniArray<z.ZodMiniString<string>>>;
        projectIds: z.ZodMiniReadonly<z.ZodMiniArray<z.ZodMiniString<string>>>;
        teamId: z.ZodMiniString<string>;
    }, z.core.$strip>;
}
/** Builds an authorization policy for Vercel workload identities accessing mainnet Zones. */
export declare function create(options: create.Options, internals?: create.Internals): create.Policy;
/** Returns the HTTP error for a failed workload-identity evaluation. */
export declare function authorizationError(result: Result): authorizationError.Options | undefined;
export declare namespace authorizationError {
    /** Public error returned when workload-identity authorization fails. */
    type Options = {
        code: 'forbidden';
        message: string;
        status: 403;
    } | {
        code: 'internal_error';
        message: string;
        status: 500;
    } | {
        code: 'unauthorized';
        message: string;
        status: 401;
    };
}
export declare namespace create {
    /** Test-only key resolver injection. */
    type Internals = {
        /** Resolves an issuer's signing keys without a remote fetch. */
        jwks?: ((issuer: string) => jose.JWTVerifyGetKey) | undefined;
    };
    /** Vercel OIDC verifier configuration grouped by authoritative Zone. */
    type Options = z.input<typeof schema.Options>;
    /** Selects organizations for enforcement and verifies their workload identities. */
    type Policy = {
        /** Whether the request principal belongs to a configured organization. */
        applies: (principal: Auth.Principal | null) => boolean;
        /** Verifies a request's bearer identity against an authoritative Zone. */
        verify: Verifier;
    };
    /** Verifies a request's bearer identity against an authoritative Zone. */
    type Verifier = (request: Request, zone: Chain) => Promise<Result>;
}
/** Sanitized Vercel OIDC evaluation emitted with the canonical request log. */
export type Result = {
    /** Authoritative Zone chain id evaluated by the policy. */
    chainId: number;
    /** Whether this evaluation blocks failed requests. */
    enforce: boolean;
    /** Verified deployment environment, present after successful verification. */
    environment?: 'development' | 'preview' | 'production' | undefined;
    /** Verification outcome. */
    outcome: 'authorized' | 'denied' | 'error';
    /** Sanitized evaluation reason. */
    reason: 'authorized' | 'forbidden' | 'invalid' | 'missing' | 'verification_unavailable';
    /** Decoded Vercel JWT fields. The encoded credential and signature are never logged. */
    token?: z.output<typeof schema.Token> | undefined;
};
export {};
//# sourceMappingURL=VercelOidc.d.ts.map