/**
 * Get an IAP identity token for accessing the given URL
 *
 * Uses `gcloud auth print-identity-token` to get a token with the correct audience.
 * Requires the user to have run `gcloud auth login` with an authorized Google account.
 *
 * @param url The URL being accessed (used to determine IAP credentials)
 * @returns Identity token string, or null if URL is not IAP-protected
 * @throws Error if gcloud is not available, not authenticated, or lacks permissions
 */
export declare function getIapToken(url: string): Promise<string | null>;
/**
 * Get IAP headers for a request to the given URL
 *
 * If the URL is IAP-protected, returns headers with Proxy-Authorization
 * containing the identity token.
 *
 * @param url The URL being requested
 * @returns Headers object to merge with request headers, or empty object
 * @throws Error if IAP token cannot be obtained
 */
export declare function getIapHeaders(url: string): Promise<Record<string, string>>;
//# sourceMappingURL=iap.d.ts.map