import type { A2AConfig } from "./types.js";
/**
 * Result of verifying an inbound A2A JWT. `email` is the caller identity from
 * the token's `sub` claim (null when verification fails), `orgDomain` mirrors
 * the verified `org_domain` claim when present.
 */
export interface A2ATokenPayload {
    email: string | null;
    orgDomain: string | null;
}
/**
 * Verify an inbound A2A bearer token (HS256) exactly as the
 * `/_agent-native/a2a` endpoint does: it peeks at the unverified `org_domain`
 * claim to build an ordered candidate-secret set (`process.env.A2A_SECRET`
 * plus any org-level secret for that domain), then verifies the JWT — checking
 * `aud`/`iss` when the token carries them and `exp` always. Returns the
 * caller's email (`sub`) and org domain on success, or `{ email: null,
 * orgDomain: null }` on any failure (malformed, bad signature, expired, or no
 * secret configured), never throwing.
 *
 * Exported so workspaces can accept A2A callers on the HTTP action route with
 * the same routine — including org-level fallback secrets — instead of
 * reimplementing a partial verifier. Pass the H3 `event` to enable org-domain →
 * org-secret lookup and audience derivation; it is optional.
 */
export declare function verifyA2AToken(token: string, event?: any): Promise<A2ATokenPayload>;
/**
 * Mount A2A protocol endpoints on an H3/Nitro app.
 *
 * - GET /.well-known/agent-card.json — public agent card (no auth)
 * - POST /_agent-native/a2a — JSON-RPC endpoint (with optional auth)
 *
 * When A2A_SECRET is set, inbound Bearer tokens are verified as JWTs
 * and the caller's email is extracted from the `sub` claim. This provides
 * cryptographic identity verification for cross-app A2A calls.
 */
export declare function mountA2A(nitroApp: any, config: A2AConfig, routePrefix?: string): void;
export declare function filterPublicAgentCardSkills(config: A2AConfig): import("./types.js").AgentSkill[];
//# sourceMappingURL=server.d.ts.map