import { type JWTPayload } from 'jose';
import type { AuthConfig } from '../config/AuthConfig.js';
import type { Authenticatable } from '../contracts/Authenticatable.js';
export type AtlexJwtPayload = JWTPayload & {
    readonly sub: string;
    readonly jti: string;
    readonly typ?: string;
    readonly fam?: string;
};
/**
 * Signs and verifies JWT access/refresh tokens using `jose`.
 */
export declare class JwtProvider {
    private readonly config;
    /**
     * @param config - JWT section of {@link AuthConfig}.
     */
    constructor(config: AuthConfig['jwt']);
    /**
     * @param payload - Claims to sign (iss/aud/iat/exp/jti applied automatically when missing).
     * @returns Compact-serialized JWT.
     */
    sign(payload: JWTPayload): Promise<string>;
    /**
     * @param token - Compact JWT.
     * @returns Verified payload.
     * @throws TokenExpiredError When `exp` is in the past.
     * @throws InvalidTokenError On signature or claim mismatch.
     */
    verify(token: string): Promise<AtlexJwtPayload>;
    /**
     * Decodes a JWT without verifying the signature (introspection only).
     *
     * @param token - Compact JWT.
     * @returns Decoded payload.
     */
    decode(token: string): Promise<AtlexJwtPayload>;
    /**
     * @param user - Authenticated principal.
     * @param claims - Optional extra claims.
     * @returns Signed access token.
     */
    generateAccessToken(user: Authenticatable, claims?: Record<string, unknown>): Promise<string>;
    /**
     * @param user - Authenticated principal.
     * @param familyId - Refresh token family identifier.
     * @returns Signed refresh token with extended TTL.
     */
    generateRefreshToken(user: Authenticatable, familyId?: string): Promise<string>;
    /**
     * @param token - JWT string (may be expired).
     * @returns `jti` claim when present.
     */
    getJti(token: string): string;
    private assertPayload;
    private getSigningKey;
    private getVerificationKey;
}
//# sourceMappingURL=JwtProvider.d.ts.map