export type AssuranceLevel = 'L1' | 'L2' | 'L3';
/** email-approval-v2 claims (plan D3). */
export interface ApprovalJwtClaims {
    iss: string;
    sub: string;
    jti: string;
    iat: number;
    exp: number;
    org: string;
    asr: AssuranceLevel;
    ih: string;
    an: number;
}
export interface VerifyApprovalOptions {
    /** Unix seconds; the verifier supplies its own clock. */
    now: number;
    /**
     * The ONLY legitimate signer (case-insensitive eth address). The TEE action
     * MUST source this from its OWN in-TEE PKP identity (the
     * VenueConnection.pkpAddress it controls) — NEVER from a caller- or
     * orchestrator-supplied parameter. If the action trusted a passed-in signer, a
     * compromised Flows would forge approvals: sign with its own key, pass its own
     * address here, and pass. This is the load-bearing D2 invariant.
     */
    expectedSigner: string;
    /** The approvalId this token must be for (binds `sub` — defense vs. token swap). */
    expectedApprovalId: string;
    /** The exact operation this approval authorizes (frozen intent hash). */
    expectedIntentHash: string;
    /** The exact account nonce — maps to the execution-layer idempotency key. */
    expectedAccountNonce: number;
    /** The org the approval must belong to (tenant isolation). */
    expectedOrg: string;
    /**
     * Minimum assurance the operation requires; the token's `asr` must meet or
     * exceed it. Fund-moving verbs ⇒ 'L2'+. Required — no implicit floor, so an
     * L1 (link-click-only) approval can never silently gate money.
     */
    requiredAssurance: AssuranceLevel;
    /** Clock-skew tolerance for iat, in seconds (default 60). */
    iatSkewSec?: number;
}
export type ApprovalReason = 'bad_signature' | 'malformed_claims' | 'expired' | 'not_yet_valid' | 'wrong_signer' | 'approval_mismatch' | 'intent_mismatch' | 'nonce_mismatch' | 'org_mismatch' | 'insufficient_assurance';
export interface ApprovalCheck {
    approved: boolean;
    reason?: ApprovalReason;
    signer?: string;
    assurance?: AssuranceLevel;
    accountNonce?: number;
    intentHash?: string;
    approvalId?: string;
}
export declare function verifyApproval(token: string, opts: VerifyApprovalOptions): ApprovalCheck;