import { JwtVerifyResult } from "./jwt-helpers.js";

//#region src/utils/internal-service-auth.d.ts

/**
 * Known internal services that can authenticate
 */
declare const InternalServices: {
  readonly INKEEP_AGENTS_RUN_API: "inkeep-agents-run-api";
  readonly INKEEP_AGENTS_MANAGE_API: "inkeep-agents-manage-api";
  readonly INKEEP_AGENTS_EVAL_API: "inkeep-agents-eval-api";
};
type InternalServiceId = (typeof InternalServices)[keyof typeof InternalServices];
/**
 * Internal Service Token JWT Claims (for service-to-service communication)
 */
interface InternalServiceTokenPayload {
  /** Issuer - always 'inkeep-agents-internal' */
  iss: string;
  /** Subject - the calling service ID */
  sub: InternalServiceId;
  /** Tenant ID scope (optional - for tenant-scoped operations) */
  tenantId?: string;
  /** Project ID scope (optional - for project-scoped operations) */
  projectId?: string;
  /** User ID scope (optional - indicates the user that originally authenticated the service) */
  userId?: string;
  /** Issued at timestamp */
  iat: number;
  /** Expiration timestamp */
  exp: number;
}
/**
 * Parameters for generating an internal service token
 */
interface GenerateInternalServiceTokenParams {
  serviceId: InternalServiceId;
  /** Optional tenant scope */
  tenantId?: string;
  /** Optional project scope */
  projectId?: string;
  /** Optional user ID scope - indicates the user that originally authenticated the service */
  userId?: string;
  /** Token expiry (default: '5m') */
  expiresIn?: string;
}
/**
 * Result of verifying an internal service token
 */
type VerifyInternalServiceTokenResult = JwtVerifyResult<InternalServiceTokenPayload>;
/**
 * Generate an internal service token for service-to-service authentication
 */
declare function generateInternalServiceToken(params: GenerateInternalServiceTokenParams): Promise<string>;
/**
 * Verify and decode an internal service token
 */
declare function verifyInternalServiceToken(token: string): Promise<VerifyInternalServiceTokenResult>;
/**
 * Extract and verify an internal service token from Authorization header
 */
declare function verifyInternalServiceAuthHeader(authHeader: string | undefined): Promise<VerifyInternalServiceTokenResult>;
/**
 * Check if a token is an internal service token (vs user/agent token)
 * by checking the issuer claim without full verification
 */
declare function isInternalServiceToken(token: string): boolean;
/**
 * Validate that the token has access to the specified tenant.
 * If token has no tenantId claim, it has access to all tenants (superuser service).
 */
declare function validateInternalServiceTenantAccess(payload: InternalServiceTokenPayload, tenantId: string): boolean;
/**
 * Validate that the token has access to the specified project.
 * If token has no projectId claim, it has access to all projects in the allowed tenant(s).
 */
declare function validateInternalServiceProjectAccess(payload: InternalServiceTokenPayload, projectId: string): boolean;
//#endregion
export { GenerateInternalServiceTokenParams, InternalServiceId, InternalServiceTokenPayload, InternalServices, VerifyInternalServiceTokenResult, generateInternalServiceToken, isInternalServiceToken, validateInternalServiceProjectAccess, validateInternalServiceTenantAccess, verifyInternalServiceAuthHeader, verifyInternalServiceToken };