/** Opaque JWT-like token string (base64url-encoded JSON + HMAC signature). */
export type TokenString = string;
/** Identity embedded inside a planner token. */
export interface PlannerTokenPayload {
    /** "planner" literal discriminator. */
    kind: 'planner';
    /** Spec that was just created. */
    specId: string;
    /** Session ID of the LLM that called create_spec. */
    sessionId: string;
    /** Model ID (e.g. "claude-opus-4-5") of the planner. */
    modelId: string;
    /** Host/agent platform identifier (e.g. "claude-code", "cursor"). */
    host: string;
    /** ISO-8601 timestamp when this token was issued. */
    issuedAt: string;
    /** ISO-8601 timestamp when this token expires (issuedAt + TTL). */
    expiresAt: string;
}
/** Identity embedded inside a reviewer token. */
export interface ReviewerTokenPayload {
    /** "reviewer" literal discriminator. */
    kind: 'reviewer';
    /** Session ID of the LLM that called issue_reviewer_token. */
    sessionId: string;
    /** Model ID (e.g. "claude-opus-4-5") of the reviewer. */
    modelId: string;
    /** Host/agent platform identifier of the reviewer. */
    host: string;
    /** ISO-8601 timestamp when this token was issued. */
    issuedAt: string;
    /** ISO-8601 timestamp when this token expires. */
    expiresAt: string;
    /** Session ID of the planner token this reviewer token is bound to. */
    plannerSessionId: string;
    /** Model ID of the planner token this reviewer token is bound to. */
    plannerModelId: string;
}
/** Signed token (payload + HMAC signature). */
export interface SignedToken<T extends PlannerTokenPayload | ReviewerTokenPayload> {
    payload: T;
    /** HMAC-SHA256 signature over the canonical JSON payload. */
    signature: string;
}
/** A planner token (issued by create_spec). */
export type PlannerToken = SignedToken<PlannerTokenPayload>;
/** A reviewer token (issued by issue_reviewer_token). */
export type ReviewerToken = SignedToken<ReviewerTokenPayload>;
/** Reviewer identity stored in ApprovalRecord (replaces raw string). */
export interface ReviewerIdentity {
    /** Display name / email / username (optional fallback for legacy). */
    displayName: string;
    /** Session ID from the reviewer token. */
    sessionId?: string | undefined;
    /** Model ID from the reviewer token. */
    modelId?: string | undefined;
    /** Host from the reviewer token. */
    host?: string | undefined;
    /** Whether this identity was verified via a signed token. */
    verified: boolean;
    /** Whether this identity was accepted in legacy mode (no token). */
    legacy: boolean;
}
/** Result of verifying a reviewer token. */
export interface TokenVerificationResult {
    valid: boolean;
    /** Why verification failed, if !valid. */
    reason?: string | undefined;
    /** Parsed reviewer payload, if valid. */
    payload?: ReviewerTokenPayload | undefined;
}
//# sourceMappingURL=reviewer-tokens.d.ts.map