import type { SpaceAuth } from "./provision.js";
/** The `iat` (issued-at, seconds) a NATS JWT carries — the monotonic generation marker persistence
 *  uses to refuse rolling a trust record BACK to an older issue of the same authority (e.g. a stale
 *  pre-rotation system account). Read-only; fails loud on anything that does not decode as a NATS
 *  JWT with a sane `iat`, because a generation that cannot be read makes staleness undecidable. */
export declare function jwtIssuedAt(jwt: string): number;
/**
 * Validate an existing full space trust bundle before a restore or other state mutation.
 *
 * This is read-only: it never generates, rotates, or signs key material, and returns the same
 * validated object. Persisted bundles may omit `sys.signingSeed`; when present, it is validated too.
 */
export declare function validateSpaceAuth(auth: unknown, expectedSpace?: string): SpaceAuth;
/**
 * Validate a bundle READ BACK from the store/disk before minting from it — accepts BOTH a full trust
 * bundle AND a stripped signer projection ({@link stripSpaceAuth}: `space` + `account.pub` +
 * `account.signingSeed` only, exactly what `cotal mint --signer` writes and a container mounts as
 * `.cotal/auth/auth.json` for `supervise`). This is what a reader like the manager needs, because in
 * the containerized deployment the signer it is handed is the stripped projection, not the full bundle.
 *
 * A FULL bundle (it carries an operator JWT) is validated in full via {@link validateSpaceAuth} — the
 * space↔account↔operator JWT chain catches a relabel. A STRIPPED projection has no JWT chain to bind
 * the space label, so it validates the mint-critical account material instead: `account.pub` and
 * `account.signingSeed` must be self-consistent account nkeys (a bare `{space}` or a garbled key is
 * refused), plus, when `expectedSpace` is given, the label. A wrong-ACCOUNT signer that slips past the
 * label is still contained — its minted creds are for a different account and the target broker rejects
 * them (fail-closed). Read-only; returns the same validated object.
 */
export declare function validateSpaceAuthForRead(auth: unknown, expectedSpace?: string): SpaceAuth;
//# sourceMappingURL=space-auth.d.ts.map