import type { ProviderAccessAttribution, ProviderResourceSelectors, Scope } from "@termfleet/core/teams/provider-access-token.js";
import type { IncomingHttpHeaders, IncomingMessage } from "node:http";
export type ValidatedAccess = {
    attribution?: ProviderAccessAttribution;
    expireAt?: number;
    scopes?: Scope[];
    selectors?: ProviderResourceSelectors;
    sub?: string;
    tokenFingerprint?: string;
};
export type RemoteAccessController = {
    remoteRequiresUserSession: boolean;
    trustAllRequests?: boolean;
    validateUserSessionToken(token: string): Promise<ValidatedAccess | void>;
};
export declare class RemoteAccessError extends Error {
    readonly status: number;
    constructor(message: string, status?: number);
}
export declare function requireHttpRemoteAccess(request: IncomingMessage, controller: RemoteAccessController, options?: {
    allowQuerySessionToken?: boolean;
    preferSessionCookie?: boolean;
}): Promise<ValidatedAccess | undefined>;
export declare function requireUpgradeRemoteAccess(request: IncomingMessage, controller: RemoteAccessController): Promise<ValidatedAccess | undefined>;
export declare function requireSocketRemoteAccess(headers: IncomingHttpHeaders, controller: RemoteAccessController, remoteAddress: string | undefined, token: string | undefined): Promise<ValidatedAccess | undefined>;
export declare function isRequestSessionAuthenticated(request: IncomingMessage, controller: RemoteAccessController): Promise<boolean>;
export declare function remoteAccessErrorResponse(error: unknown): {
    body: string;
    status: number;
};
export declare function readRemoteAccessToken(value: unknown): string | undefined;
export declare function readRequestSessionToken(headers: IncomingHttpHeaders): string | null;
export declare function isLoopbackHost(host: string): boolean;
export declare function isLocalConsoleOwnerRequest(request: IncomingMessage): boolean;
export declare function isSameOriginRequest(request: IncomingMessage): boolean;
export declare function internalErrorBody(request: IncomingMessage, error: unknown): string;
export declare function isLocalSocketAddress(address: string | undefined): boolean;
export declare function isLocalNetworkAddress(address: string | undefined): boolean;