export type CacheRequestContext = {
    token?: string;
    projectId?: string;
    projectSlug?: string;
};
/** The credential and project reference a cache backend read is made under. */
export interface ResolvedCacheAuthority {
    token: string | null;
    projectRef: string | null;
    /** Which context supplied the token. Safe to log; never the token itself. */
    tokenSource: string;
}
export declare function getCacheRequestContext(): CacheRequestContext | null;
/**
 * Resolve the credential and project reference a cache backend read would be
 * made under.
 *
 * This only reports whether a token is PRESENT. Whether it is still VALID is
 * decided server side by the API call itself, so a caller that skips that call
 * cannot learn about a revocation from this result.
 */
export declare function resolveCacheRequestAuthority(explicitApiToken?: string): ResolvedCacheAuthority;
/**
 * Non-reversible, per-process identity for a cache credential.
 *
 * Used to keep two credentials from sharing a process-local cache scope. The
 * salt is random per process and never leaves it, so the digest is meaningless
 * outside this process and cannot be precomputed. It is not a cryptographic
 * commitment, so callers must also scope on the project reference rather than
 * relying on this alone.
 *
 * Two domain-separated folds are concatenated rather than one, giving a 128-bit
 * identity. This is the widening `cache/keys/dependency-pinning.ts` already
 * applies for the same reason, and it keeps the digest SYNCHRONOUS, which
 * `buildImmutableL1Scope` requires because it runs inline on every read. A
 * single 64-bit fold was already infeasible to collide deliberately here: the
 * salt never leaves the process, so there is no offline search, and a birthday
 * collision would need on the order of 2^63 live credentials inside one short
 * TTL window. But a collision between two live credentials would merge their
 * cache scopes, and widening removes the argument for the cost of one extra
 * pass over a short string, on a path that is otherwise about to make an HTTP
 * round trip.
 */
export declare function cacheCredentialIdentity(token: string): string;
//# sourceMappingURL=request-authority.d.ts.map