import { type JwtClaims, type TokenType } from "../../contracts/auth.js";
import { type JwksLookupOptions } from "./jwks.js";
export interface SignJwtOptions {
    privateKeyPem: string;
    kid: string;
    claims: Omit<JwtClaims, "iss" | "aud" | "exp" | "iat" | "jti"> & {
        iss: string;
        aud: string | string[];
        expiresInSeconds: number;
        jti?: string;
    };
}
export type KeyResolver = (kid: string) => Promise<string>;
export interface VerifyJwtOptions {
    jwks?: JwksLookupOptions;
    keyResolver?: KeyResolver;
    expectedIssuer: string;
    expectedAudience: string;
    expectedTokenType?: TokenType;
    clockToleranceSeconds?: number;
}
export declare function signJwt(options: SignJwtOptions): string;
export declare function verifyJwt(token: string, options: VerifyJwtOptions): Promise<JwtClaims>;
export declare function unsafeDecodeJwtPayload(token: string): unknown;
//# sourceMappingURL=tokens.d.ts.map