/**
 * remote/sub-token-otel — OpenTelemetry instrumentation for sub-tokens (P11).
 *
 * Sub-token mint / verify / revoke are security-critical actions. Without
 * observability, operators flying blind can't detect : a sudden burst of
 * mints, a spike in verify-failures (signature brute-force), revocation
 * floods, or a clock-skew issue that exp-rejects every token.
 *
 * This module wraps the pure functions in `sub-token.ts` with OTEL spans
 * + counters. The pure module stays free of OTEL imports (preserves the
 * "library code is environment-agnostic" property) ; consumers opt in
 * by importing from this file instead.
 *
 * Why a separate file
 * -------------------
 *   - `sub-token.ts` is a stable surface used by tests + CLI + browser
 *     PWA. Avoiding the @opentelemetry/api import keeps that surface
 *     tree-shakeable + bundleable for the web.
 *   - This file is opt-in : the http-server adapter + CLI publish surface
 *     point at it, but a thin SDK consumer can keep using `sub-token.ts`
 *     directly with zero OTEL overhead.
 *
 * Span shape
 * ----------
 *   subtoken.mint
 *     attributes: subtoken.scope, subtoken.ttl_sec, subtoken.success
 *   subtoken.verify
 *     attributes: subtoken.result (valid | malformed | expired | sig_mismatch
 *                | revoked | unknown_scope | wrong_version), subtoken.scope
 *   subtoken.revoke
 *     attributes: subtoken.jti.hash (sha256 truncated, 8 chars — never the
 *                raw jti so logs aren't tokens themselves)
 *     subtoken.was_revoked (idempotency signal)
 *
 * Metric shape
 * ------------
 *   counter subtoken.mints_total{scope}                 — every mint
 *   counter subtoken.verifies_total{result,scope?}      — every verify call
 *   counter subtoken.revocations_total{idempotent}      — every revoke call
 *
 * No-op cost
 * ----------
 * `@opentelemetry/api` returns a no-op tracer + meter when no SDK is
 * registered. The overhead is ~50ns per call ; the security wins are
 * worth it even in pure-loopback dev.
 *
 * @public @since 2.22.0 — preste P11 (sub-token observability)
 */
import { type MintSubTokenOptions, type SubTokenScope, type VerifySubTokenResult } from "./sub-token.js";
/** Truncated SHA-256 of a jti for safe logging. */
export declare function hashJti(jti: string): string;
/**
 * Instrumented variant of `mintSubToken`. Emits a span and increments
 * the `subtoken.mints_total` counter. Forwards all option semantics.
 */
export declare function mintSubTokenInstrumented(opts: MintSubTokenOptions): string;
/**
 * Instrumented variant of `verifySubToken`. Always ends in a span ; the
 * failure shape (`{valid:false,reason}`) is preserved verbatim so the
 * caller's branching is unchanged.
 */
export declare function verifySubTokenInstrumented(parentToken: string, token: string, now?: number): VerifySubTokenResult;
/**
 * Instrumented variant of `resolveAuthScope`. Wraps a single verify span
 * and a `subtoken.parent_match` attribute when the presented token is the
 * parent itself (skipping the sub-token verify path).
 */
export declare function resolveAuthScopeInstrumented(parentToken: string, presentedToken: string, now?: number, isRevoked?: (jti: string) => boolean): SubTokenScope | undefined;
/**
 * Record a revocation event. Pure metrics helper — the actual deny-list
 * mutation lives in the http-server / persistence layer. Pass `alreadyRevoked`
 * so the idempotency-vs-new dimension stays observable.
 */
export declare function recordRevocation(jti: string, alreadyRevoked: boolean): void;
/**
 * Map a `verifySubToken` reason string to a coarse-grained outcome label
 * (kept stable for dashboards). Exported for tests.
 */
export declare function classifyReason(reason: string): string;
//# sourceMappingURL=sub-token-otel.d.ts.map