import type { JwtClaims, TokenType } from "../../contracts/auth.js";
import type { JsonObject } from "../../contracts/json.js";
import type { JwtVerifier } from "../../contracts/route.js";
import type { RsaKeyPair } from "./keypair.js";
export interface BpTokenIssuerOptions {
    keyPair: RsaKeyPair;
    issuer: string;
    audience: string;
    accessTokenSeconds: number;
    refreshTokenSeconds?: number;
}
export interface BpTokenUser {
    sub: string;
    tenantId: string;
    appId: string;
    roles?: string[];
    authProvider?: string;
    refreshContext?: JsonObject;
    providerSubject?: string;
    provider?: JwtClaims["provider"];
    name?: string;
    email?: string;
    picture?: string;
}
export interface BpTokenPairUser extends BpTokenUser {
    authProvider: string;
    refreshContext: JsonObject;
}
export interface BpIssuedTokenPair {
    tokenId: string;
    accessToken: string;
    accessTokenExpiresInSeconds: number;
    refreshToken?: string;
    refreshTokenExpiresInSeconds?: number;
}
export interface BpRefreshTokenValidation {
    refreshToken: string;
    tenantId: string;
    appId: string;
}
export declare function createBpTokenIssuer(options: BpTokenIssuerOptions): {
    signAccessToken(input: BpTokenUser): string;
    issueTokenPair(input: BpTokenPairUser, pairOptions?: {
        includeRefreshToken?: boolean;
    }): BpIssuedTokenPair;
    verifyRefreshToken(input: BpRefreshTokenValidation): Promise<JwtClaims>;
    verifier(expectedTokenType?: TokenType): JwtVerifier;
};
export type BpTokenIssuer = ReturnType<typeof createBpTokenIssuer>;
//# sourceMappingURL=issuer.d.ts.map