/**
 * Who may talk to the box session host.
 *
 * The desktop app opens every connection with the person's HQ ID token. This
 * module checks it the way any careful server would — RS256 signature against
 * the user pool's published keys, issuer, expiry, and that it really is an ID
 * token — and hands back the subject, which the connection then compares with
 * the box's owner.
 *
 * Node's own crypto does the verifying, so the CLI gains no new dependency.
 *
 * The box learns its owner and its user pool from its OWN cached sign-in: an
 * Outpost signs in as a machine identity whose ID token names the owning person
 * in `custom:delegatedSub`, while older boxes hold the person's own token. A
 * company agent box has no human owner, so nobody may drive sessions on it.
 */
export interface Jwk {
    kty: string;
    n: string;
    e: string;
    kid: string;
    alg?: string;
    use?: string;
}
export interface VerifiedIdentity {
    sub: string;
    email?: string;
}
export type TokenRejection = "malformed" | "bad-algorithm" | "unknown-key" | "bad-signature" | "wrong-issuer" | "wrong-token-use" | "wrong-audience" | "expired" | "not-yet-valid" | "jwks-unavailable";
export type TokenVerdict = {
    ok: true;
    identity: VerifiedIdentity;
} | {
    ok: false;
    reason: TokenRejection;
};
export type VerifyToken = (token: string) => Promise<TokenVerdict>;
export interface CognitoIdTokenVerifierOptions {
    /** The user pool's issuer URL, taken from the box's own sign-in. */
    issuer: string;
    fetchJwks: (url: string) => Promise<{
        keys: Jwk[];
    }>;
    /** Epoch milliseconds. */
    now?: () => number;
    /** When set, the token's `aud` must be one of these app clients. */
    audiences?: string[];
    clockSkewSeconds?: number;
    /** How often an unknown key id may trigger a re-fetch. */
    jwksRefetchIntervalMs?: number;
}
export declare function createCognitoIdTokenVerifier(options: CognitoIdTokenVerifierOptions): VerifyToken;
export type BoxIdentity = {
    ok: true;
    ownerSub: string;
    issuer: string;
} | {
    ok: false;
    reason: "not-signed-in" | "no-owner" | "bad-issuer";
};
/**
 * Read the box's own cached ID token to learn which user pool to trust and
 * whose sign-in may drive sessions here.
 *
 * The token comes off the box's own disk, so it is decoded rather than
 * verified — but the issuer is still checked against the Cognito shape, because
 * it decides where the signing keys are fetched from.
 */
export declare function resolveBoxIdentity(idToken: string | undefined): BoxIdentity;
//# sourceMappingURL=session-host-auth.d.ts.map