/**
 * HybridValidator — JWT verification + RFC 7662 introspection.
 *
 * TypeScript parity port of python/runtime/validator.py.
 *
 * Supports four ValidationMode shapes; ``jwt_and_introspect`` is the
 * production-recommended setting. JWT verification uses cached JWKS keys via
 * the ``jose`` package; introspection uses HTTP Basic auth with the
 * configured introspectionClientId / introspectionClientSecret.
 */
import { type Config } from './config.js';
import { type Principal } from './principal.js';
/** Denial-taxonomy code attached to ValidationError. */
export type ValidationErrorCode = 'invalid_token' | 'invalid_audience' | 'token_inactive';
/** Error raised when the token fails validation or introspection. */
export declare class ValidationError extends Error {
    readonly code: ValidationErrorCode;
    constructor(code: ValidationErrorCode, message: string);
}
/**
 * Validates bearer tokens via JWT + introspection.
 *
 * Construct with ``newValidator()`` which validates the config first, or
 * directly via ``new HybridValidator(cfg)``.
 */
export declare class HybridValidator {
    readonly cfg: Config;
    private readonly mode;
    private jwks;
    private jwksInit;
    constructor(cfg: Config);
    private ensureJwks;
    /**
     * Validate ``token`` and return a populated Principal.
     *
     * Throws ``ValidationError`` with ``.code`` ∈ ``invalid_token`` /
     * ``token_inactive`` on failure.
     */
    validate(token: string): Promise<Principal>;
    private validateJwtAndIntrospect;
    private validateJwtOrIntrospect;
    private validateJwt;
    private introspect;
    private checkActive;
    private mergePrincipals;
}
/** Construct a HybridValidator after validating the config. */
export declare function newValidator(cfg: Config): HybridValidator;
//# sourceMappingURL=validator.d.ts.map