import type { TokenString, PlannerTokenPayload, TokenVerificationResult } from './types.js';
/**
 * Verify a planner token: checks signature and expiry.
 * Returns the decoded payload if valid, or a rejection reason.
 */
export declare function verifyPlannerToken(projectPath: string, raw: TokenString): Promise<{
    valid: boolean;
    payload?: PlannerTokenPayload;
    reason?: string;
}>;
/**
 * Verify a reviewer token against the planner token.
 *
 * Rules enforced (SPEC-722):
 *  1. Both tokens must have valid HMAC signatures.
 *  2. Reviewer token must not be expired.
 *  3. reviewerToken.sessionId !== plannerToken.sessionId  (no self-approval).
 *  4. reviewerToken.modelId !== plannerToken.modelId  OR a multiTeammateReviewId is provided.
 */
export declare function verifyReviewerToken(projectPath: string, reviewerTokenRaw: TokenString, plannerTokenRaw: TokenString, opts?: {
    multiTeammateReviewId?: string;
}): Promise<TokenVerificationResult>;
/**
 * SPEC-727: Verify that a reviewer token is bound to the correct planner token.
 *
 * The reviewer token embeds the planner's sessionId (as `plannerSessionId`).
 * This function decodes the reviewer token and compares its embedded plannerSessionId
 * to the sessionId in `plannerTokenOnSpec`.
 *
 * Does NOT verify HMAC here — callers must call `verifyReviewerToken` for full verification.
 * This function is a lightweight pair-match check to guard disagreement counter increments.
 */
export declare function verifyTokenPair(reviewerToken: string, plannerTokenOnSpec: string): {
    ok: boolean;
    reason?: 'INVALID_TOKEN_PAIR';
};
//# sourceMappingURL=verifier.d.ts.map