import type { AuthProvider } from "../../extensions/auth/index.js";
/** Public API contract for hosted service auth error code. */
export type HostedServiceAuthErrorCode = "UNAUTHENTICATED" | "FORBIDDEN" | "NOT_FOUND" | "SERVER_ERROR";
/** Error shape for hosted service auth. */
export declare class HostedServiceAuthError extends Error {
    readonly statusCode: number;
    readonly errorCode: HostedServiceAuthErrorCode;
    constructor(statusCode: number, message: string);
}
/** Error shape for is hosted service auth. */
export declare function isHostedServiceAuthError(error: unknown): error is HostedServiceAuthError;
export declare const AgentServiceAuthError: typeof HostedServiceAuthError;
export type AgentServiceAuthError = HostedServiceAuthError;
export type AgentServiceAuthErrorCode = HostedServiceAuthErrorCode;
/** Request payload for hosted service authenticated. */
export type HostedServiceAuthenticatedRequest = {
    authToken: string;
    userId: string;
};
/** Claims that bind an internal run-event append token to one durable run. */
export type HostedServiceRunEventAppendTokenInput = {
    token: string;
    projectId: string;
    runId: string;
};
/**
 * Outcome of verifying an internal run-event append token.
 *
 * `integrationTools` carries the server-resolved integration tool grant. It is
 * read from the signed token rather than the request body, so a caller cannot
 * widen its own grant by editing what it posts.
 */
export type HostedServiceRunEventAppendTokenResult = {
    verified: boolean;
    integrationTools?: readonly string[];
};
/**
 * Verifiers may return a bare boolean; the richer result is optional so existing
 * host implementations keep working unchanged.
 */
export type HostedServiceRunEventAppendTokenVerification = boolean | HostedServiceRunEventAppendTokenResult;
/** Normalize either verifier shape into the richer result. */
export declare function toRunEventAppendTokenResult(verification: HostedServiceRunEventAppendTokenVerification): HostedServiceRunEventAppendTokenResult;
/** Error shape for hosted service jwt. */
export type HostedServiceJwtError = {
    statusCode: number;
    errorCode: HostedServiceAuthErrorCode;
    message: string;
};
/** Result returned from hosted service jwt. */
export type HostedServiceJwtResult = {
    success: true;
    userId: string;
    email: string;
    token: string;
} | {
    success: false;
    error: HostedServiceJwtError;
};
/** Error shape for hosted service project access. */
export type HostedServiceProjectAccessError = {
    statusCode: number;
    errorCode: HostedServiceAuthErrorCode;
    message: string;
};
/** Result returned from hosted service project access. */
export type HostedServiceProjectAccessResult = {
    success: true;
    projectId: string;
    projectSlug?: string;
} | {
    success: false;
    error: HostedServiceProjectAccessError;
};
/** Configuration used by hosted service auth. */
export type HostedServiceAuthConfig = {
    OAUTH_PUBLIC_KEY?: string | null;
    SERVICE_ACCOUNT_VERYFRONT_SERVER_ID?: string | null;
    NODE_ENV?: string | null;
    VERYFRONT_API_URL: string;
};
/** Public API contract for hosted service auth logger. */
export type HostedServiceAuthLogger = {
    debug?: (message: string, metadata?: Record<string, unknown>) => void;
    error?: (message: string, metadata?: Record<string, unknown>) => void;
};
/** Public API contract for hosted service auth trace. */
export type HostedServiceAuthTrace = <TResult>(operationName: string, operation: () => Promise<TResult>) => Promise<TResult>;
/** Public API contract for hosted service auth fetch. */
export type HostedServiceAuthFetch = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
export type HostedServiceJwtVerifier = Pick<AuthProvider, "verifyWithPublicKey">;
/** Options accepted by hosted service auth. */
export type HostedServiceAuthOptions = {
    getConfig: () => HostedServiceAuthConfig;
    logger?: HostedServiceAuthLogger;
    trace?: HostedServiceAuthTrace;
    fetch?: HostedServiceAuthFetch;
    authProvider?: HostedServiceJwtVerifier;
    projectAccessTimeoutMs?: number;
};
/** Public API contract for hosted service auth. */
export type HostedServiceAuth = {
    authenticateRequest: (request: Request) => Promise<HostedServiceAuthenticatedRequest | Response>;
    getTokenFromRequest: typeof getHostedServiceTokenFromRequest;
    verifyJwt: (token: string) => Promise<HostedServiceJwtResult>;
    /**
     * Always reports the richer result. The permissive
     * {@link HostedServiceRunEventAppendTokenVerification} union is for callers
     * that accept a host-supplied verifier, not for this implementation's own
     * output — narrowing it here keeps `.verified` readable without a cast.
     */
    verifyRunEventAppendToken: (input: HostedServiceRunEventAppendTokenInput) => Promise<HostedServiceRunEventAppendTokenResult>;
    verifyProjectAccess: (projectId: string, token: string) => Promise<HostedServiceProjectAccessResult>;
};
export type AgentServiceAuthenticatedRequest = HostedServiceAuthenticatedRequest;
export type AgentServiceJwtError = HostedServiceJwtError;
export type AgentServiceJwtResult = HostedServiceJwtResult;
export type AgentServiceProjectAccessError = HostedServiceProjectAccessError;
export type AgentServiceProjectAccessResult = HostedServiceProjectAccessResult;
export type AgentServiceAuthConfig = HostedServiceAuthConfig;
export type AgentServiceAuthLogger = HostedServiceAuthLogger;
export type AgentServiceAuthTrace = HostedServiceAuthTrace;
export type AgentServiceAuthFetch = HostedServiceAuthFetch;
export type AgentServiceAuthOptions = HostedServiceAuthOptions;
export type AgentServiceAuth = HostedServiceAuth;
/** Request payload for get hosted service token from. */
export declare function getHostedServiceTokenFromRequest(request: Request): string | null;
export declare const getAgentServiceTokenFromRequest: typeof getHostedServiceTokenFromRequest;
/** Create hosted service auth. */
export declare function createHostedServiceAuth(options: HostedServiceAuthOptions): HostedServiceAuth;
export declare const createAgentServiceAuth: typeof createHostedServiceAuth;
export declare const isAgentServiceAuthError: typeof isHostedServiceAuthError;
//# sourceMappingURL=auth.d.ts.map