import { type ServiceConfigAction, type ServiceConfigTicketClaims } from "../contracts/serviceConfig.js";
/** Audience every BetterPortal service-config ticket is minted for. */
export declare const CONFIG_TICKET_AUDIENCE = "betterportal-service-config";
export interface SignServiceConfigTicketOptions {
    /** PEM of the CP signing key (cpState.keyPair.privateKeyPem). */
    privateKeyPem: string;
    /** kid published in the CP JWKS. */
    kid: string;
    /** CP issuer (cpState.issuer); becomes the `iss` claim and verifier expectation. */
    issuer: string;
    tenantId: string;
    serviceId: string;
    actions: ServiceConfigAction[];
    subject?: string;
    bindingId?: string;
    expiresInSeconds: number;
    jti?: string;
}
/**
 * Mint a config ticket as an RS256 JWT signed by the control plane's key.
 * Replaces the legacy symmetric HMAC ticket - services verify it against the
 * CP JWKS, so no shared secret is required and only the CP can issue tickets.
 */
export declare function signServiceConfigTicket(options: SignServiceConfigTicketOptions): string;
export interface VerifyServiceConfigTicketOptions {
    /** JWKS endpoint of the issuing control plane (delivered to the service at redeem). */
    jwksUri?: string;
    /** In-process key lookup, used instead of jwksUri when supplied (no network). */
    keyResolver?: (kid: string) => Promise<string> | string;
    /** Expected `iss` - the CP URL the service was installed against. */
    issuer: string;
    /** This service's id; the ticket's `serviceId` must match. */
    serviceId: string;
    clockToleranceSeconds?: number;
}
/**
 * Verify a CP-signed config ticket against the CP JWKS. Throws on any failure.
 * Pins RS256, rejects jku/x5u key references, and re-checks iss/aud/exp/serviceId
 * after library verification (defence in depth).
 */
export declare function verifyServiceConfigTicket(token: string, options: VerifyServiceConfigTicketOptions): Promise<ServiceConfigTicketClaims>;
/**
 * Build a `validateTicket` callback for `registerServiceConfigRoutes` that
 * verifies CP-signed tickets against the CP JWKS. Returns null (not throw) on
 * any failure so the route responds 401 rather than 500.
 */
export declare function createCpConfigTicketValidator(options: VerifyServiceConfigTicketOptions): (ticketValue: string | null, ...rest: unknown[]) => Promise<ServiceConfigTicketClaims | null>;
export declare function clearConfigTicketJwksCache(): void;
//# sourceMappingURL=configTicket.d.ts.map