export interface SpawnToken {
    type: 'orchestrator' | 'agent';
    sessionId: string;
    issuedTo: string;
    issuedBy: string;
    depth: number;
    maxDepth: number;
    canGenerate: boolean;
    expiresAt: number;
    signature: string;
}
export interface OrchestrationPolicyConfig {
    recursionEnabled: boolean;
    maxDepth: number;
    maxActiveAgents: number;
}
interface ValidateResult {
    valid: boolean;
    reason?: string | undefined;
}
interface CanSpawnResult {
    allowed: boolean;
    reason?: string | undefined;
}
/**
 * Manages spawn tokens for the bounded recursive orchestration security model.
 *
 * Security model (3 layers):
 *   1. Policy gate  , recursionEnabled must be true
 *   2. Capacity gate, currentAgentCount < maxActiveAgents && depth <= maxDepth
 *   3. Token gate   , token must be valid, authentic, not expired, and canGenerate
 */
export declare class SpawnTokenManager {
    private secret;
    private tokens;
    constructor(sessionId: string);
    private sign;
    private verifySignature;
    /**
     * Create the orchestrator token. Called once at session start.
     * The orchestrator token can generate agent tokens.
     */
    createOrchestratorToken(ttlMs?: number): SpawnToken;
    /**
     * Generate an agent token from an orchestrator token.
     * Returns null if the orchestrator token is invalid or cannot generate.
     */
    generateAgentToken(orchestratorToken: SpawnToken, agentId: string, ttlMs?: number): SpawnToken | null;
    /**
     * Validate a token is authentic (correct HMAC), registered, and not expired.
     */
    validate(token: SpawnToken): ValidateResult;
    /**
     * Check if spawning is allowed given config constraints and token.
     * 3-layer check: config gate → capacity gate → token gate.
     */
    canSpawn(token: SpawnToken, config: OrchestrationPolicyConfig, currentAgentCount: number): CanSpawnResult;
    /**
     * Revoke a token by its signature.
     * Returns true if the token was found and revoked.
     */
    revoke(tokenSignature: string): boolean;
}
export {};
//# sourceMappingURL=spawn-tokens.d.ts.map