import { type NatsCalloutConfig, type Settings } from "@opengeni/config";
import { type Database } from "@opengeni/db";
import { type ResponderConnection } from "@opengeni/events";
import type { Observability } from "@opengeni/observability";
/** The NATS subject nats-server publishes authorization requests on (ADR-26). */
export declare const AUTH_CALLOUT_SUBJECT = "$SYS.REQ.USER.AUTH";
/** Keep live NATS credentials short-lived while never outliving the bearer. */
export declare const NATS_USER_JWT_TTL_SECONDS: number;
export interface AuthCalloutDeps {
    db: Database;
    settings: Settings;
    callout: NatsCalloutConfig;
    observability?: Observability;
}
/**
 * The pure validate→scoped-JWT decision, isolated from the NATS transport so it is
 * unit-testable. Given the raw authorization-request JWT bytes, returns the signed
 * authorization-response JWT bytes to reply with — a GRANT (embedding a scoped user
 * JWT) on success, a DENIAL (carrying `nats.error`, no user JWT) otherwise. NEVER
 * throws on a bad/invalid request: every failure becomes a signed denial (the
 * server then refuses the connection cleanly).
 */
export declare function handleAuthorizationRequest(deps: AuthCalloutDeps, requestBytes: Uint8Array): Promise<Uint8Array>;
/**
 * Start the auth-callout responder: open a SEPARATE NATS connection authenticated
 * as the callout `auth_users` user, subscribe $SYS.REQ.USER.AUTH, and answer every
 * authorization request via {@link handleAuthorizationRequest}. Returns a handle
 * whose `close()` drains the connection. Gated by the caller (sandboxSelfhostedEnabled
 * + a resolvable callout config); a deployment without the callout plane never starts
 * it.
 */
export declare function startAuthCalloutResponder(deps: AuthCalloutDeps, natsUrl: string): Promise<ResponderConnection>;