import { type KeyObject } from 'node:crypto';
/**
 * A JWT signer, in about forty lines, using `node:crypto` and nothing else.
 *
 * The repository's rule is to reach for a package before writing one, and the
 * obvious package here is `jose`. It is not used, for a reason that is about
 * this monorepo rather than about the library: `jose` is ESM-only, these
 * packages compile to CommonJS, and the workarounds — a dynamic import in a
 * synchronous path, or moving one package's module system — cost more than the
 * code they save.
 *
 * What is left is small because **nothing here verifies a token it did not
 * make**. Every dangerous part of JWT is on the verifying side: `alg: none`,
 * algorithm confusion, a key chosen by the header, an unvalidated `kid`. Two
 * tokens are produced — Google's save link and Apple's APNs authentication —
 * and both are read by somebody else. {@link verifyJwt} exists for the tests and
 * takes the algorithm as an argument rather than reading it from the header,
 * which is the one decision that makes the difference.
 *
 * The cryptography itself is Node's.
 */
export type JwtAlgorithm = 'RS256' | 'ES256';
export interface JwtHeader {
    alg: JwtAlgorithm;
    typ: 'JWT';
    /** Which key signed this, when the reader holds several. APNs requires it. */
    kid?: string;
}
/**
 * Signs a set of claims.
 *
 * `claims` is written as given: no `iat` is added, no `exp` is invented. A token
 * whose lifetime is decided somewhere other than the call site is a token nobody
 * can reason about, and both callers here have their own rules about it.
 */
export declare function signJwt(claims: Record<string, unknown>, key: KeyObject | Buffer | string, options: {
    algorithm: JwtAlgorithm;
    keyId?: string;
}): string;
export interface JwtParts {
    header: JwtHeader;
    claims: Record<string, unknown>;
}
/**
 * Checks a token against a key, with the algorithm supplied by the caller.
 *
 * **The algorithm is an argument and never read from the header.** That is the
 * whole of the defence: a verifier that trusts `alg` can be handed `none`, or an
 * HMAC token signed with the public key it was going to verify with.
 *
 * Returns `null` rather than throwing on a bad token, because the callers are
 * tests asserting a refusal.
 */
export declare function verifyJwt(token: string, key: KeyObject | Buffer | string, algorithm: JwtAlgorithm): JwtParts | null;
/** The claims, without checking anything. For logs and for error messages only. */
export declare function decodeJwtClaims(token: string): Record<string, unknown> | null;
//# sourceMappingURL=jwt.d.ts.map