/**
 * Assert a prefix is well-shaped. Throws via the caller's `invalidArg`
 * function so `createChallenge` / `verifyChallenge` can raise
 * `ChallengeError` with the right code — this module stays free of the
 * error class dependency.
 *
 * @param {string} prefix
 * @param {string} name
 * @param {(msg: string) => Error} invalidArg
 * @returns {string}
 */
export function assertPrefix(prefix: string, name: string, invalidArg: (msg: string) => Error): string;
/**
 * Random ID for the token's `jti` claim — 128 bits of entropy, encoded
 * as 22 base64url characters. Used as the store key for single-use
 * enforcement, so it must be unpredictable and unique per token.
 *
 * @returns {string}
 */
export function newJti(): string;
/**
 * Sign a payload with `secret` and return the compact token string.
 *
 * @param {object} payload
 * @param {Buffer} secret     32+ raw bytes; caller validates length.
 * @param {string} [prefix]   Wire prefix; defaults to {@link DEFAULT_PREFIX}.
 * @returns {string}
 */
export function sign(payload: object, secret: Buffer, prefix?: string): string;
/**
 * Parse + HMAC-verify a token. Returns the decoded payload on success,
 * or a reason string on any failure. Never throws on user-input
 * problems — a wrong token is a normal auth outcome.
 *
 * @param {string} token
 * @param {Buffer} secret
 * @param {string} [prefix]   Expected prefix; defaults to {@link DEFAULT_PREFIX}.
 * @returns {{ payload: object } | { reason: 'malformed' | 'bad_signature' }}
 */
export function decode(token: string, secret: Buffer, prefix?: string): {
    payload: object;
} | {
    reason: "malformed" | "bad_signature";
};
export const DEFAULT_PREFIX: "chall_v1";