import { type TenantId } from '@substrat-run/contracts';
import { type BuilderAuth } from './auth.js';
interface PushTokenClaim {
    v: 1;
    tenantId: string;
    tenantSlug: string;
    actor: string;
    iat: number;
}
/**
 * The audited subject for a tenant's CI pushes — deterministic from the tenant, so
 * every push from that tenant's pipelines lands in the admin log under ONE nameable
 * actor (the mirror of builder-auth's `builderActorFor`, which is per-human; CI is
 * per-tenant because the pipeline, not a person, is what authenticated).
 */
export declare function pushActorFor(tenantId: TenantId): Promise<string>;
/** Mint a push token for one tenant. `iat` is informational (no expiry in v1). */
export declare function mintPushToken(secret: string, identity: {
    actor: string;
    tenantId: TenantId;
    tenantSlug: string;
}): Promise<string>;
/** Verify a push token string → its claim, or null (bad prefix/shape/signature). */
export declare function verifyPushToken(secret: string, token: string): Promise<PushTokenClaim | null>;
/**
 * A `BuilderAuth` over push tokens: reads `x-service-token`, handles only `spt1.…`
 * values (anything else → null, falling through to the other readers), verifies, and
 * returns the builder principal the token carries. Compose with the OIDC reader via
 * `firstBuilderAuth`.
 */
export declare function pushTokenBuilderAuth(secret: string): BuilderAuth;
export {};
//# sourceMappingURL=push-token.d.ts.map