import type { WorkspaceBinding } from './workspaceState';
export declare const ACCESS_TOKEN_KIND = "ba";
export interface AccessTokenClaims {
    k: typeof ACCESS_TOKEN_KIND;
    w_id: string;
    st: 'ws' | 'dev';
    sid: string;
    jti?: string;
    iat?: number;
    exp: number;
}
export interface VerifiedIdentity {
    workspaceId: string;
    subjectType: 'ws' | 'dev';
    subjectId: string;
    jti?: string;
    exp: number;
}
/**
 * Extract a buttress access token from a request. Prefers the Authorization
 * Bearer header; falls back to ?access_token / ?token query params for clients
 * (browser WebSocket, RN file transfer) that can't set headers.
 */
export declare const extractAccessTokenFromRequest: (headers: Record<string, string | undefined> | undefined, query: Record<string, unknown> | undefined) => string | null;
export declare const verifyAccessToken: (token: string | null, binding: WorkspaceBinding | null) => Promise<VerifiedIdentity | null>;
