import { type AuthBridgeErrorCode, type VerifiedIdentity } from "@sema-agent/settings-schema/api/auth-bridge";
import type { Logger } from "./observability/logger.js";
import type { Metrics } from "./observability/metrics.js";
export type { VerifiedIdentity } from "@sema-agent/settings-schema/api/auth-bridge";
export interface RegistryJwtVerifierOptions {
    /** R4 — 期望 iss(registry 的 SSO_ISSUER;默认=SEMA_REGISTRY_URL,双侧去尾斜杠比较)。 */
    issuer: string;
    /** R2 — JWKS 绝对 URL(默认=issuer + REGISTRY_JWKS_PATH)。 */
    jwksUrl?: string;
    /** R7 — 设了则 aud 必须包含它;不设=忽略 aud。 */
    audience?: string;
    clockSkewSec?: number;
    jwksRefreshMinIntervalSec?: number;
    offlineGraceSec?: number;
    /** 常规(非 kid-miss)缓存刷新周期——过期后下一次 verify 顺路重拉(成功前旧键继续用,R8 语义)。 */
    jwksTtlSec?: number;
    logger?: Logger;
    metrics?: Pick<Metrics, "inc" | "observe">;
    /** 测试注入。 */
    fetchImpl?: typeof fetch;
    nowMs?: () => number;
}
export type VerifyOutcome = {
    ok: true;
    identity: VerifiedIdentity;
} | {
    ok: false;
    error: AuthBridgeErrorCode;
};
/** The live object `createRegistryJwtVerifier` produces — a single `verify` entry point over the process-level JWKS cache. */
export interface RegistryJwtVerifier {
    verify: (bearer: string) => Promise<VerifyOutcome>;
}
/**
 * registry-JWT verifier(单例,进程级 JWKS 缓存)。`verify(bearer)` 全程不 throw——一切异常折为
 * AUTH_BRIDGE_ERROR_CODES(HTTP 面由调用方恒答 generic 401,码只进日志/metrics,R9)。
 */
export declare function createRegistryJwtVerifier(opts: RegistryJwtVerifierOptions): RegistryJwtVerifier;
//# sourceMappingURL=auth-bridge.d.ts.map