export interface ShortLivedTokenClaims {
    resourceId: string;
    viewerEmail?: string;
    /**
     * Optional display name of the agent the token was minted for. Signed so a
     * reader cannot rename itself, but audit/display-only like `viewerEmail` —
     * never consult it for authorisation.
     */
    agentLabel?: string;
    ttlSeconds?: number;
}
export interface ShortLivedTokenKeyOptions {
    /**
     * Sign or verify with this key alone, never the app's server secret, so a
     * token minted under another key (one derived from `A2A_SECRET`, say)
     * cannot pass. An empty key throws rather than fall back.
     */
    signingKey?: string;
}
export type VerifyResult = {
    ok: true;
    viewerEmail?: string;
    agentLabel?: string;
} | {
    ok: false;
    reason: string;
};
export declare function signShortLivedToken(claims: ShortLivedTokenClaims, options?: ShortLivedTokenKeyOptions): string;
/**
 * Verify a token previously produced by {@link signShortLivedToken}.
 *
 * Returns `{ ok: true, viewerEmail? }` only when:
 *  - the token has the expected shape (`<payload>.<sig>`),
 *  - the signature matches via constant-time comparison,
 *  - the token has not expired,
 *  - the embedded `resourceId` matches `expectedResourceId`.
 *
 * Otherwise returns `{ ok: false, reason: <error string> }`. Callers should
 * not surface the reason to viewers (it's useful for server-side logs only).
 */
export declare function verifyShortLivedToken(token: string, expectedResourceId: string, options?: ShortLivedTokenKeyOptions): VerifyResult;
export declare function signCompactShortLivedToken(claims: ShortLivedTokenClaims): string;
/**
 * Verify a token produced by {@link signCompactShortLivedToken}. A token for a
 * different resource, and any `signShortLivedToken` token, fails as
 * `bad_signature` — the id is not in the payload, so a mismatch is
 * indistinguishable from tampering.
 */
export declare function verifyCompactShortLivedToken(token: string, expectedResourceId: string): VerifyResult;
/** Payload `typ` discriminator for realtime subscribe tokens. */
export declare const REALTIME_SUBSCRIBE_TOKEN_TYPE = "rt-subscribe";
export interface RealtimeSubscribeClaims {
    projectId: string;
    owner?: string;
    orgId?: string;
    ttlSeconds?: number;
    /**
     * Absolute unix-seconds ceiling, independent of `exp`. The gateway re-signs a
     * stream's token every few minutes without consulting the app, so `exp` alone
     * lets one mint be extended forever and a revoked session keeps streaming.
     * Rotation copies this verbatim and never extends it.
     */
    absExp?: number;
}
export type RealtimeVerifyResult = {
    ok: true;
    projectId: string;
    owner?: string;
    orgId?: string;
    exp: number;
    absExp?: number;
} | {
    ok: false;
    reason: string;
};
export declare function signRealtimeSubscribeToken(claims: RealtimeSubscribeClaims, key: string): string;
/**
 * Verify a realtime subscribe token against the app's per-project `key` and the
 * connect channel `projectId`. Returns the identity claims only when the shape,
 * signature (constant-time), `typ`, `exp`, and `projectId` binding all hold.
 */
export declare function verifyRealtimeSubscribeToken(token: string, expected: {
    projectId: string;
    key: string;
}): RealtimeVerifyResult;
export declare const REALTIME_VOICE_CAPABILITY_TOKEN_TYPE = "rt-voice-capability";
export interface RealtimeVoiceCapabilityClaims {
    userEmail: string;
    orgId?: string;
    browserTabId?: string;
    toolNames: readonly string[];
    discoveredToolNames?: readonly string[];
    ttlSeconds?: number;
}
export type RealtimeVoiceCapabilityVerifyResult = {
    ok: true;
    userEmail: string;
    orgId?: string;
    browserTabId?: string;
    toolNames: string[];
    discoveredToolNames: string[];
} | {
    ok: false;
    reason: string;
};
/**
 * Mint a capability authorising `claims.toolNames` for one realtime voice
 * session. The token is a bounded manifest scope layered on top of the
 * caller's session cookie — never a standalone credential.
 */
export declare function signRealtimeVoiceCapability(claims: RealtimeVoiceCapabilityClaims, ttlSecondsDefault: number): string;
export declare function verifyRealtimeVoiceCapability(token: string | undefined, expected: {
    userEmail: string;
    orgId?: string;
    browserTabId?: string;
}): RealtimeVoiceCapabilityVerifyResult;
/** Payload `typ` discriminator for gateway access-check tokens. */
export declare const GATEWAY_ACCESS_TOKEN_TYPE = "rt-access-check";
export interface GatewayAccessClaims {
    projectId: string;
    resourceType: string;
    resourceId: string;
    userEmail: string;
    orgId?: string;
    ttlSeconds?: number;
}
export type GatewayAccessVerifyResult = {
    ok: true;
    projectId: string;
    resourceType: string;
    resourceId: string;
    userEmail: string;
    orgId?: string;
} | {
    ok: false;
    reason: string;
};
export declare function signGatewayAccessToken(claims: GatewayAccessClaims, key: string): string;
export declare function verifyGatewayAccessToken(token: string, key: string, expectedProjectId?: string): GatewayAccessVerifyResult;