/**
 * Owner-auth credentials (#999, specs/2026-10-03-owner-auth.md).
 *
 * Mints and verifies the credentials that tell the owner apart from agents:
 * - **agent badge** — per-session, injected into each agent's environment at
 *   launch (`CREWLY_AGENT_BADGE`) and sent by the skills as `X-Agent-Badge`;
 * - **owner session** — the dashboard's HttpOnly cookie, plus a CSRF token
 *   derived from it;
 * - **internal credential** — what the in-process relay / Cloud forwarders
 *   present when they call this backend over loopback, and (`scheduler`) what
 *   the scheduled-commands runner hands each command it spawns so it can
 *   message agents and do nothing else.
 *
 * Everything is an HMAC under one secret that lives only in this process's
 * memory. It is never written to disk and never put in an environment, so an
 * agent (same OS user) cannot read it from a file the way it can read
 * `~/.crewly/api-token`. A restart rotates it: dashboards re-bootstrap their
 * session and the restarted agents get new badges.
 *
 * @module services/core/owner-auth.service
 */
/** Purposes an internal credential can carry. */
export type InternalCredentialPurpose = 'relay' | 'cloud' | 'scheduler';
/** A verified owner session. */
export interface OwnerSession {
    /** Random session id (base64url) */
    id: string;
    /** Issue time, epoch seconds */
    issuedAt: number;
}
/** A freshly minted owner session. */
export interface MintedOwnerSession extends OwnerSession {
    /** Cookie value */
    value: string;
    /** CSRF token for this session */
    csrfToken: string;
}
/**
 * Mint the agent badge for a session. Deterministic for the process
 * lifetime, so minting twice for the same session gives the same badge.
 *
 * @param session - Agent session name
 * @returns `cab1.<base64url session>.<mac>`
 *
 * @example
 * ```ts
 * env[OWNER_AUTH_CONSTANTS.AGENT_BADGE_ENV] = mintAgentBadge('crewly-orc');
 * ```
 */
export declare function mintAgentBadge(session: string): string;
/**
 * Verify an agent badge.
 *
 * @param badge - Presented badge (may be missing)
 * @returns The session it was minted for, or null when invalid
 */
export declare function verifyAgentBadge(badge: string | null | undefined): string | null;
/**
 * Headers for a backend-internal call made on an agent's behalf (the
 * WorkItem dispatcher, TL auto-verify, the ticket assignee waker …).
 *
 * @param session - The agent session the call acts as
 * @returns `X-Agent-Session` plus that session's badge
 */
export declare function internalAgentHeaders(session: string): Record<string, string>;
/**
 * The CSRF token for a session id.
 *
 * @param sessionId - Owner session id
 * @returns base64url MAC
 */
export declare function csrfTokenFor(sessionId: string): string;
/**
 * Mint a new owner session.
 *
 * @param nowMs - Clock (tests)
 * @returns Cookie value, id, issue time and CSRF token
 */
export declare function mintOwnerSession(nowMs?: number): MintedOwnerSession;
/**
 * Verify an owner session cookie value.
 *
 * @param value - Cookie value (may be missing)
 * @param nowMs - Clock (tests)
 * @returns The session, or null when invalid or older than OWNER_SESSION_MAX_AGE_S
 */
export declare function verifyOwnerSession(value: string | null | undefined, nowMs?: number): OwnerSession | null;
/**
 * Whether a CSRF token matches a session.
 *
 * @param sessionId - Owner session id
 * @param token - Presented CSRF token (may be missing)
 * @returns True when valid
 */
export declare function verifyCsrfToken(sessionId: string, token: string | null | undefined): boolean;
/**
 * The credential an in-process forwarder presents on its loopback calls.
 *
 * @param purpose - `relay` (phone / portal REST), `cloud` (Cloud-forwarded Slack envelopes) or `scheduler` (a scheduled command's child process)
 * @returns Header value
 */
export declare function mintInternalCredential(purpose: InternalCredentialPurpose): string;
/**
 * Verify an internal credential.
 *
 * @param value - Presented value (may be missing)
 * @returns Its purpose, or null when invalid
 */
export declare function verifyInternalCredential(value: string | null | undefined): InternalCredentialPurpose | null;
/**
 * Headers an in-process relay forwarder adds to its loopback call.
 *
 * @param purpose - Credential purpose
 * @returns `{ 'x-crewly-internal': … }`
 */
export declare function internalCredentialHeaders(purpose: InternalCredentialPurpose): Record<string, string>;
/**
 * Name of the owner session cookie for a listening port.
 *
 * @param port - The backend's local port
 * @returns e.g. `crewly_owner_8787`
 */
export declare function ownerSessionCookieName(port: number | string | undefined): string;
/**
 * Forget the signing secret (tests): every badge, session and internal
 * credential minted before stops verifying.
 */
export declare function resetOwnerAuthSecretForTesting(): void;
//# sourceMappingURL=owner-auth.service.d.ts.map