import { JwtVerifyResult } from "./jwt-helpers.js";

//#region src/utils/service-token-auth.d.ts

/**
 * Service Token JWT Claims (for agent-to-agent communication)
 */
interface ServiceTokenPayload {
  /** Issuer - always 'inkeep-agents' */
  iss: string;
  /** Audience - the target agent ID */
  aud: string;
  /** Subject - the origin agent ID */
  sub: string;
  /** Tenant ID - must match for both origin and target agents */
  tenantId: string;
  /** Project ID - must match for both origin and target agents */
  projectId: string;
  /** Original initiator of the request (propagated through delegation chain) */
  initiatedBy?: {
    type: 'user' | 'api_key';
    id: string;
  };
  /** App ID - propagated through delegation chain for app-scoped requests */
  appId?: string;
  /** Issued at timestamp */
  iat: number;
  /** Expiration timestamp (5 minutes from issue) */
  exp: number;
}
/**
 * Parameters for generating a service token
 */
interface GenerateServiceTokenParams {
  tenantId: string;
  projectId: string;
  originAgentId: string;
  targetAgentId: string;
  initiatedBy?: {
    type: 'user' | 'api_key';
    id: string;
  };
  appId?: string;
}
/**
 * Result of verifying a service token
 */
type VerifyServiceTokenResult = JwtVerifyResult<ServiceTokenPayload>;
/**
 * Generate a JWT token for agent-to-agent authentication.
 * Token expires in 1 hour.
 */
declare function generateServiceToken(params: GenerateServiceTokenParams): Promise<string>;
/**
 * Verify and decode a service JWT token
 */
declare function verifyServiceToken(token: string): Promise<VerifyServiceTokenResult>;
/**
 * Validate that the token's tenant ID matches the expected tenant.
 * This prevents cross-tenant delegation attempts.
 */
declare function validateTenantId(payload: ServiceTokenPayload, expectedTenantId: string): boolean;
/**
 * Validate that the token's target agent ID matches the expected agent
 */
declare function validateTargetAgent(payload: ServiceTokenPayload, expectedTargetAgentId: string): boolean;
/**
 * Extract the Authorization header and verify the bearer token
 */
declare function verifyAuthorizationHeader(authHeader: string | undefined): Promise<VerifyServiceTokenResult>;
//#endregion
export { GenerateServiceTokenParams, ServiceTokenPayload, VerifyServiceTokenResult, generateServiceToken, validateTargetAgent, validateTenantId, verifyAuthorizationHeader, verifyServiceToken };