/**
 * AUTH KEY-SET parsing ([ref] A4) — the env→key-set decoders for the two D-G credential planes, moved VERBATIM
 * out of security.ts: {@link parseApprovalHmacKeys} (APPROVAL_HMAC_KEYS — the rotating HMAC secret set, decision
 * INTEGRITY) and {@link parsePrincipalJwks} (PRINCIPAL_JWT_PUBKEYS — the rotating issuer public-key set, principal
 * IDENTITY). config.ts consumes ONLY these two functions + their row types at env-load time, and importing them from
 * security.ts made the base config layer value-depend on the whole 55KiB auth module (lens2 §F). This file is a pure
 * leaf (JSON.parse + shape filters, zero repo imports); the VERIFIERS that consume the parsed key-sets
 * (verifyApprovalHmac / verifyPrincipalJwt) stay in ./approval-hmac.ts and ./principal-jwt.ts; consumers import these four names from HERE ([ref] 兼容面全清).
 */
/** One key in the rotating HMAC key-set. `kid` lets the verifier pick the signing key (or fall back to trying the
 *  whole set); `status` lets sema-registry rotate without breaking in-flight approvals: `active` = sign + verify,
 *  `retiring` = verify-only (kept for the overlap window so a MAC signed with the old key still verifies). */
export interface ApprovalHmacKey {
    kid: string;
    key: string;
    status?: "active" | "retiring";
}
/**
 * [ref](黑板 [ref]③「坏值禁静默回默认」)—— 一条**被丢弃**的 key-set 条目的诊断。
 *
 * 为什么两个解析器要新长一个必填出口:它们的 fail-closed 方向是对的(坏形 ⇒ `[]` ⇒ 门关着),但**丢弃
 * 本身此前零留痕**。真场景:轮换新钥时手滑把 `key` 写成 `secret`,这一条被 `filter` 悄悄滤掉,进程照常
 * 起、旧钥还在、验签照常过 —— 直到旧钥退役那天,全部审批回决在生产上一起开始 401,而配置早在几周前就
 * 已经坏了。诊断出口让「我加的那把钥没进来」在 boot 当场可见。
 *
 * `index` 是**原数组下标**(operator 拿它直接定位是 JSON 里第几条);`"-"` = 整体形坏(不是数组 / 不是
 * JSON),没有可指的条目。`reason` 只说**缺陷字段名**,永不带值 —— HMAC 的 `key` 是对称密钥,诊断行会
 * 进日志。
 */
export interface KeySetRejection {
    index: number | "-";
    reason: string;
}
/**
 * 诊断出口**必填**(不是 `onReject?:`)。可选回调 = 「没人接就等于错误蒸发」,正是本仓 [ref] 静默降级
 * 门数的 SHAPE B;这两条钥又都在凭据轴上,所以由**类型**逼每个调用点当场表态,而不是靠人记得去接。
 */
export type OnKeySetRejection = (rejection: KeySetRejection) => void;
/** Parse APPROVAL_HMAC_KEYS — a sema-registry-managed, rotating key-SET, as a JSON array of {kid,key,status}.
 *  Empty / unset / unparseable ⇒ `[]` ⇒ HMAC verification is OFF (D-G inactive; back-compat, BFF-only door).
 *  fail-closed 语义与改前**逐字相同**;新增的只有 `onReject`([ref]:每一条被丢弃的条目都要说出来)。 */
export declare function parseApprovalHmacKeys(raw: string | undefined, onReject: OnKeySetRejection): ApprovalHmacKey[];
/** One issuer public key in the rotating principal JWKS (mirror of the HMAC key-set rotation discipline). The
 *  `alg` is PINNED per key — the JWT header's alg MUST match it, killing alg-confusion (`none`, HS-with-the-pubkey).
 *  `key` is a PEM (SPKI) public key. PUBLIC, non-secret. */
export interface PrincipalJwtKey {
    kid: string;
    alg: "EdDSA" | "RS256" | "ES256";
    key: string;
    status?: "active" | "retiring";
}
/** Parse PRINCIPAL_JWT_PUBKEYS — a JSON array of {kid,alg,key,status}. Empty/unset/malformed ⇒ [] ⇒ no trust
 *  anchor ⇒ the direct door cannot open (D-G inactive). Each entry must have kid + a pinned alg + a PEM key.
 *  [ref]: fail-closed 语义逐字不变,但每条被丢弃的条目经 `onReject` 报出(序号 + 缺陷字段名,不带值)——
 *  这里的 key 是**公**钥,但 reason 仍只说字段名,与 HMAC 那条同形(两个出口的口径不该分岔)。 */
export declare function parsePrincipalJwks(raw: string | undefined, onReject: OnKeySetRejection): PrincipalJwtKey[];
//# sourceMappingURL=auth-keys.d.ts.map