import { type CliJwtVerifiedClaims, type CliVerifiedPrincipal } from "./jwt.js";
export type CliBearerSessionLookup = Pick<CliVerifiedPrincipal, "sessionId" | "ownerAddress" | "agentKey">;
export type CliBearerActiveSession = {
    scope: string;
};
export type CliBearerVerifyToken = (rawToken: string) => Promise<CliJwtVerifiedClaims | null>;
export type CliBearerReadActiveSession = (principal: CliBearerSessionLookup) => Promise<CliBearerActiveSession | null>;
export type CliBearerAuthFailureCode = "missing_token" | "invalid_token" | "inactive_session" | "scope_required";
export type CliBearerAuthSuccess = {
    ok: true;
    principal: CliVerifiedPrincipal;
};
export type CliBearerAuthFailure = {
    ok: false;
    code: CliBearerAuthFailureCode;
    requiredScope?: string;
};
export type CliBearerAuthResult = CliBearerAuthSuccess | CliBearerAuthFailure;
type VerifyCliBearerAuthParams = {
    authorization?: unknown;
    rawToken?: string;
    verifyAccessToken: CliBearerVerifyToken;
    readActiveSession: CliBearerReadActiveSession;
    requiredScopes?: readonly string[];
};
export declare function verifyCliBearerAuth(params: VerifyCliBearerAuthParams): Promise<CliBearerAuthResult>;
export {};