export interface ProxyAccessControlLogger {
    debug: (msg: string, extra?: Record<string, unknown>) => void;
    info: (msg: string, extra?: Record<string, unknown>) => void;
    warn: (msg: string, extra?: Record<string, unknown>) => void;
    error: (msg: string, error?: unknown, extra?: Record<string, unknown>) => void;
}
export interface ProtectedProxyEnvironment {
    id?: string;
    name: string;
    protected?: boolean;
}
/** Who a verified token speaks for at the gate, and what it is bound to. */
export interface ProxyPrincipal {
    userId: string;
    /** Present for an environment access token: the one target it may open. */
    environmentAccess?: {
        projectId: string;
        environmentId: string;
    };
}
/**
 * Reads the principal off a verified payload.
 *
 * A plain user token speaks for its user. An environment access token has to
 * say so twice, by audience and by use, and name both the project and the
 * environment it is bound to; anything that claims only part of that is not a
 * credential this gate issued for and is refused outright.
 */
export declare function toProxyPrincipal(payload: unknown): ProxyPrincipal | undefined;
export interface ProtectedProxyProjectUser {
    id: string;
}
export interface ProxyAccessError {
    status: number;
    message: string;
    redirectUrl?: string;
}
export declare function extractUserIdFromToken(token: string, apiBaseUrl: string, log?: ProxyAccessControlLogger): Promise<string | undefined>;
export declare function extractProxyPrincipal(token: string, apiBaseUrl: string, log?: ProxyAccessControlLogger): Promise<ProxyPrincipal | undefined>;
export declare function buildProxyAuthRedirectUrl(url: URL): string;
export declare function isProjectMember(users: ProtectedProxyProjectUser[] | undefined, userId: string | undefined): boolean;
export declare function checkProtectedProxyAccess(input: {
    url: URL;
    matchingEnv: ProtectedProxyEnvironment | undefined;
    /** The project the matching environment belongs to, for bound tokens. */
    projectId?: string;
    userToken: string | undefined;
    users: ProtectedProxyProjectUser[] | undefined;
    apiBaseUrl: string;
    logger?: ProxyAccessControlLogger;
    logContext?: Record<string, unknown>;
    isSignedInternalControlPlaneRequest: boolean;
    extractPrincipal?: (token: string, apiBaseUrl: string, log?: ProxyAccessControlLogger) => Promise<ProxyPrincipal | undefined>;
}): Promise<ProxyAccessError | null>;
//# sourceMappingURL=proxy-access-control.d.ts.map