import { type CpEnvelopeClaims, type SetupTokenClaims } from "../../contracts/auth.js";
import { type JwksLookupOptions } from "./jwks.js";
export interface SignCpEnvelopeOptions {
    privateKeyPem: string;
    kid: string;
    claims: Omit<CpEnvelopeClaims, "exp" | "iat" | "jti"> & {
        expiresInSeconds: number;
        jti?: string;
    };
}
export interface SignSetupTokenOptions {
    privateKeyPem: string;
    kid: string;
    claims: Omit<SetupTokenClaims, "exp" | "iat" | "jti"> & {
        expiresInSeconds: number;
        jti?: string;
    };
}
export interface VerifyEnvelopeOptions {
    /** JWKS lookup details for the issuer (CP). */
    jwks?: JwksLookupOptions;
    /** Or an in-process key resolver (preferred for installer flow). */
    keyResolver?: (kid: string) => Promise<string>;
    expectedIssuer: string;
    expectedAudience?: string;
    clockToleranceSeconds?: number;
}
export declare function signCpEnvelope(options: SignCpEnvelopeOptions): string;
export declare function signSetupToken(options: SignSetupTokenOptions): string;
export declare function verifyCpEnvelope(token: string, options: VerifyEnvelopeOptions): Promise<CpEnvelopeClaims>;
export declare function verifySetupToken(token: string, options: VerifyEnvelopeOptions): Promise<SetupTokenClaims>;
//# sourceMappingURL=envelope.d.ts.map