import { SignJWT, jwtVerify } from 'jose';
/** Top-level payload field carrying the token (DEC-S2.18). */
export declare const INTERNAL_JWT_FIELD = "_internalJwt";
export declare const INTERNAL_ISSUER = "skillera-gateway";
export declare const INTERNAL_ALG = "EdDSA";
export declare const INTERNAL_JWT_TTL_SEC = 30;
export declare const INTERNAL_JWT_CLOCK_TOLERANCE = "5s";
/** Signing key material jose accepts for EdDSA (CryptoKey/KeyObject/Uint8Array). */
export type SigningKey = Parameters<SignJWT['sign']>[0];
/** Verification key material: a static key OR a remote JWKS getter function. */
export type VerificationKey = SigningKey | Parameters<typeof jwtVerify>[1];
export interface InternalTokenInput {
    audience: string;
    subject: string;
    cmd: string;
    reqHash: string;
    tenantId?: string;
    snapId?: string;
    permHash?: string;
    unscoped?: boolean;
    ip?: string;
    ua?: string;
    rid?: string;
    obo?: string;
    jti?: string;
    nowSec?: number;
}
export interface InternalClaims {
    iss: string;
    aud: string;
    sub: string;
    tnt?: string;
    snap?: string;
    ph?: string;
    unsc?: boolean;
    ip?: string;
    ua?: string;
    rid?: string;
    obo?: string;
    cmd: string;
    req: string;
    jti: string;
    iat: number;
    exp: number;
}
/** DEC-S2.7: sign the canonical claim set. Header carries `kid` for rotation. */
export declare function signInternalToken(key: SigningKey, kid: string, input: InternalTokenInput): Promise<string>;
/** Reason labels for verify failures (DEC-S2.30 metrics + Step 7 audit). */
export type InternalAuthReason = 'missing' | 'sig' | 'exp' | 'aud' | 'jwks' | 'hash' | 'cmd' | 'replay' | 'backend';
export declare class InternalAuthError extends Error {
    readonly reason: InternalAuthReason;
    constructor(reason: InternalAuthReason, message?: string);
}
/**
 * DEC-S2.23 step 2: verify signature + iss + aud + exp via jose. Maps jose errors to
 * an InternalAuthError with a precise reason label. Does NOT check body-hash/cmd/replay
 * (the caller does, after re-extracting the payload) — see assert* helpers below.
 */
export declare function verifyInternalToken(jwt: string, key: VerificationKey, audience: string): Promise<InternalClaims>;
/** DEC-S2.23 step 3: re-hash the payload (token field already removed) and compare. */
export declare function assertBodyHash(claims: InternalClaims, payloadWithoutToken: unknown): void;
/** DEC-S2.23 step 4: the token's cmd must match the actual NATS pattern. */
export declare function assertCmd(claims: InternalClaims, cmd: string): void;
//# sourceMappingURL=internal-token.d.ts.map