/**
 * CLI-scope token. A compact HMAC-signed payload (same shape as
 * cookie-session tokens but with a different claim set) that the
 * cortex CLI gets at login and presents on every MCP request via the
 * Authorization: Bearer header.
 *
 * Different claim shape from the cookie session keeps domains
 * separate — a forged cookie can't be reused as a CLI bearer and
 * vice versa, because verifyScopeToken rejects anything missing the
 * `scopes` field.
 *
 * Signing key: shared with cookie-session — pyre-web's stored
 * `gatewaySecret` per deployment, Cortex's `PRZM_CORTEX_GATEWAY_SECRET`
 * env var. Single key per deployment keeps key management simple
 * for v1; per-key rotation lands with the dedicated cortex-api-keys
 * collection follow-up.
 */
export interface ScopeClaims {
    /** Subject — pyre-web user id (numeric). */
    sub: number;
    /** Tenant id. */
    tenant: number;
    /**
     * Bundle names the bearer is authorized for. Canonical: "read",
     * "ingest", "admin"; custom bundles (future enterprise RBAC) get
     * stamped here too under the same field. Cortex resolves to a
     * concrete tool set via expandScopes().
     */
    scopes: string[];
    /** Issued-at, unix seconds. */
    iat: number;
    /** Expiry, unix seconds. */
    exp: number;
}
/** Sign + serialize a scope token. */
export declare function signScopeToken(claims: ScopeClaims, key: string): string;
/**
 * Verify a scope token. Returns the claims on success, `null` on any
 * failure (bad signature, expired, missing scopes claim).
 *
 * Tokens not starting with the `cscope.` prefix are rejected
 * immediately — they're being presented as Bearer values, but the
 * legacy opaque bearer (PRZM_CORTEX_API_AUTH_TOKEN) doesn't carry the
 * prefix, so the prefix is the cheap discriminator that lets a
 * single Authorization header serve both paths.
 */
export declare function verifyScopeToken(token: string, key: string): ScopeClaims | null;
/**
 * Convenience: return the verified scope claims for a request's
 * Authorization header, or null when the header is missing /
 * malformed / opaque-bearer (i.e. NOT a cscope token). Callers use
 * this to figure out the tool surface; missing claims means "fall
 * back to full surface" (the legacy opaque-bearer path) so existing
 * scripts and the dashboard's gateway-secret access keep working.
 */
export declare function readScopeClaimsFromAuthHeader(authHeader: string | undefined, key: string | undefined): ScopeClaims | null;
//# sourceMappingURL=scope-token.d.ts.map