/**
 * Minimal HS256 JWT — sign/verify/decode helpers built on Web Crypto.
 *
 * Scope: signed tokens you embed into URLs sent over WhatsApp — renewal
 * links, magic logins, opt-in confirmations, account-link redirects. The
 * pattern: the bot mints a token carrying a small payload + an HMAC over
 * the URL-safe header.payload, the user taps a link with the token in the
 * query string, the renewal page verifies + decodes.
 *
 * NOT scope: a general-purpose JWT library. No RS256, no `exp` / `nbf`
 * enforcement, no JWS multi-sig. If you need any of that, use `jose`. The
 * primitive here is deliberately small (~100 LOC, zero deps) and constant-
 * time on verify, which covers the WhatsApp-URL use case both `aysu` and
 * `bibliafala` had to re-implement.
 *
 * Generic over the claims shape — `sign<MyClaims>(...)` / `verify<MyClaims>(...)`
 * give you typed payloads on the way in and out.
 */
export type JwtClaims = Record<string, unknown>;
export interface JwtSigner<Claims extends JwtClaims = JwtClaims> {
    sign(payload: Claims): Promise<string>;
    verify(token: string): Promise<Claims | null>;
    decodeUnsafe(token: string): Claims | null;
}
/**
 * Build a JwtSigner pre-bound to a secret. Use when the same secret signs
 * + verifies many tokens (the typical case for a single bot).
 *
 *   const jwt = createJwtSigner<{ pix: string; amount: string }>({ secret: env.PIX_JWT_SECRET });
 *   const token = await jwt.sign({ pix: '...', amount: '49.90' });
 *   const claims = await jwt.verify(token); // claims is { pix, amount } | null
 */
export declare function createJwtSigner<Claims extends JwtClaims = JwtClaims>({ secret }: {
    secret: string;
}): JwtSigner<Claims>;
/**
 * Sign `payload` with HS256 using `secret`.
 */
export declare function signJwt<Claims extends JwtClaims = JwtClaims>(payload: Claims, secret: string): Promise<string>;
/**
 * Verify `token` against `secret`. Returns the decoded claims on success,
 * `null` on any failure (malformed token, bad signature, unparseable payload).
 *
 * Constant-time signature comparison.
 */
export declare function verifyJwt<Claims extends JwtClaims = JwtClaims>(token: string, secret: string): Promise<Claims | null>;
/**
 * Decode-only — no signature verification.
 *
 * Use when the secret can't reach the caller (e.g. a browser-side renewal
 * page that should NOT hold the signing key). The contract: trust the
 * server that issued the token, not the token itself.
 */
export declare function decodeJwtUnsafe<Claims extends JwtClaims = JwtClaims>(token: string): Claims | null;
//# sourceMappingURL=jwt.d.ts.map