type KeyInput$4 = any | Buffer | Uint8Array | string | Record<string, unknown>;

type KeyInput$3 = KeyInput$4;
type KeyResolverFn$2 = (header: Record<string, unknown>) => KeyInput$3 | Promise<KeyInput$3>;

/**
 * @typedef {import('./internal/keys.js').KeyInput} KeyInput
 *
 * @typedef {Object} SignOptions
 * @property {string} alg
 * @property {string | number} [expiresIn]
 * @property {string | number} [notBefore]
 * @property {string} [issuer]
 * @property {string | string[]} [audience]
 * @property {string} [subject]
 * @property {boolean | { size?: number, encoding?: string } | (() => string | Promise<string>)} [jwtId]
 * @property {string} [nonce]
 * @property {string} [typ]                                  Header `typ`. Default `'JWT'`. `'at+jwt'` for RFC 9068.
 * @property {string} [kid]
 * @property {Record<string, unknown>} [header]
 * @property {boolean} [noTimestamp]
 * @property {boolean} [returnMetadata]
 *
 * @typedef {Object} SignResultMeta
 * @property {string} token
 * @property {string} [jti]
 * @property {Date} [expiresAt]
 * @property {Date} [issuedAt]
 * @property {string} alg
 * @property {string} [kid]
 */
/**
 * @param {Record<string, unknown>} payload
 * @param {KeyInput} key
 * @param {SignOptions} options
 * @returns {Promise<string | SignResultMeta>}
 */
declare function sign(payload: Record<string, unknown>, key: KeyInput$2, options: SignOptions$1): Promise<string | SignResultMeta>;
type KeyInput$2 = KeyInput$4;
type SignOptions$1 = {
    alg: string;
    expiresIn?: string | number | undefined;
    notBefore?: string | number | undefined;
    issuer?: string | undefined;
    audience?: string | string[] | undefined;
    subject?: string | undefined;
    jwtId?: boolean | {
        size?: number;
        encoding?: string;
    } | (() => string | Promise<string>) | undefined;
    nonce?: string | undefined;
    /**
     * Header `typ`. Default `'JWT'`. `'at+jwt'` for RFC 9068.
     */
    typ?: string | undefined;
    kid?: string | undefined;
    header?: Record<string, unknown> | undefined;
    noTimestamp?: boolean | undefined;
    returnMetadata?: boolean | undefined;
};
type SignResultMeta = {
    token: string;
    jti?: string | undefined;
    expiresAt?: Date | undefined;
    issuedAt?: Date | undefined;
    alg: string;
    kid?: string | undefined;
};

type ClaimsOptions$2 = {
    issuer?: string | RegExp | string[] | (string | RegExp)[] | ((claimed: string) => boolean | Promise<boolean>) | undefined;
    audience?: string | RegExp | string[] | (string | RegExp)[] | ((claimed: string) => boolean | Promise<boolean>) | undefined;
    subject?: string | undefined;
    nonce?: string | undefined;
    typ?: string | string[] | undefined;
    requiredClaims?: string[] | undefined;
    requiredScopes?: string[] | undefined;
    clockTolerance?: string | number | undefined;
    maxAge?: string | number | undefined;
    currentDate?: Date | undefined;
};

/**
 * @typedef {Object} DecodedJwt
 * @property {Record<string, unknown>} header
 * @property {Record<string, unknown>} payload
 * @property {Buffer} signature
 */
/**
 * @param {string} token
 * @returns {DecodedJwt}
 */
declare function decode(token: string): DecodedJwt$1;
/**
 * @param {string} token
 * @returns {Record<string, unknown>}
 */
declare function decodeProtectedHeader(token: string): Record<string, unknown>;
type DecodedJwt$1 = {
    header: Record<string, unknown>;
    payload: Record<string, unknown>;
    signature: Buffer;
};

/**
 * @param {string} token
 * @param {KeyInput | KeyInput[] | KeyResolverFn} keyish
 * @param {VerifyOptions} options
 * @returns {Promise<VerifyResult>}
 */
declare function verify(token: string, keyish: KeyInput$1 | KeyInput$1[] | KeyResolverFn$1, options: VerifyOptions$1): Promise<VerifyResult$1>;
/**
 * Verify the signature but **skip claim validation**. Use for audit
 * paths where you need a trustworthy identity even from an expired
 * token. Never gate authorisation on this — use `verify` for that.
 *
 * @param {string} token
 * @param {KeyInput | KeyInput[] | KeyResolverFn} keyish
 * @param {Pick<VerifyOptions, 'alg' | 'knownCriticalHeaders' | 'maxTokenSize'>} options
 * @returns {Promise<VerifyResult>}
 */
declare function peek(token: string, keyish: KeyInput$1 | KeyInput$1[] | KeyResolverFn$1, options: Pick<VerifyOptions$1, "alg" | "knownCriticalHeaders" | "maxTokenSize">): Promise<VerifyResult$1>;
type KeyInput$1 = KeyInput$4;
type KeyResolverFn$1 = KeyResolverFn$2;
type ClaimsOptions$1 = ClaimsOptions$2;
type VerifyOptions$1 = ClaimsOptions$1 & {
    alg: string[];
    knownCriticalHeaders?: Iterable<string>;
    maxTokenSize?: number;
};
type VerifyResult$1 = {
    header: Record<string, unknown>;
    payload: Record<string, unknown>;
    kid: string | undefined;
};

/**
 * Shared base error class — the single error structure behind every
 * `@exortek/*` package's `errors.js`.
 *
 * Every package keeps its own class identity with a one-liner subclass;
 * codes stay per-package frozen maps, status mapping is declared as a
 * static field:
 *
 *   import { BaseError } from '@exortek/shared/errors';
 *
 *   export const ErrorCode = Object.freeze({
 *     INVALID_ARGUMENT: 'INVALID_ARGUMENT',
 *     INVALID_TOKEN: 'INVALID_TOKEN',
 *   });
 *
 *   export class JwtError extends BaseError {
 *     static statuses = { INVALID_ARGUMENT: 400, INVALID_TOKEN: 401 };
 *     static defaultStatus = 500;
 *   }
 *
 * Instances carry a stable machine-readable `code` (branch on this,
 * never on the message), an optional HTTP `status`, an optional
 * `details` object, and the standard `cause` chain.
 */
declare class BaseError extends Error {
    /**
     * Optional `code → HTTP status` map declared on the subclass. When
     * absent the instance carries no `status` at all — for HTTP-agnostic
     * packages like `@exortek/crypto`.
     *
     * @type {Record<string, number> | undefined}
     */
    static statuses: Record<string, number> | undefined;
    /**
     * Fallback status for codes missing from `statuses`.
     *
     * @type {number}
     */
    static defaultStatus: number;
    /**
     * @param {string} code    Stable machine-readable code; branch on this.
     * @param {string} message Human-readable diagnostic. Free-form; may
     *                         change across versions.
     * @param {{ cause?: unknown, status?: number, details?: Record<string, unknown> }} [options]
     */
    constructor(code: string, message: string, options?: {
        cause?: unknown;
        status?: number;
        details?: Record<string, unknown>;
    });
    /** @type {string} */
    code: string;
    /** @type {number | undefined} */
    status: number | undefined;
    /** @type {Record<string, unknown> | undefined} */
    details: Record<string, unknown> | undefined;
}

declare const ErrorCode: Readonly<{
    INVALID_ARGUMENT: "INVALID_ARGUMENT";
    INVALID_TOKEN: "INVALID_TOKEN";
    INVALID_HEADER: "INVALID_HEADER";
    INVALID_PAYLOAD: "INVALID_PAYLOAD";
    INVALID_SIGNATURE: "INVALID_SIGNATURE";
    INVALID_KEY: "INVALID_KEY";
    UNSUPPORTED_ALGORITHM: "UNSUPPORTED_ALGORITHM";
    ALGORITHM_MISMATCH: "ALGORITHM_MISMATCH";
    ALGORITHM_NONE_FORBIDDEN: "ALGORITHM_NONE_FORBIDDEN";
    MISSING_ALG_ALLOWLIST: "MISSING_ALG_ALLOWLIST";
    TOKEN_EXPIRED: "TOKEN_EXPIRED";
    TOKEN_NOT_YET_VALID: "TOKEN_NOT_YET_VALID";
    TOKEN_TOO_OLD: "TOKEN_TOO_OLD";
    TOKEN_TOO_LARGE: "TOKEN_TOO_LARGE";
    INVALID_ISSUER: "INVALID_ISSUER";
    INVALID_AUDIENCE: "INVALID_AUDIENCE";
    INVALID_SUBJECT: "INVALID_SUBJECT";
    INVALID_NONCE: "INVALID_NONCE";
    INVALID_TYP: "INVALID_TYP";
    INSUFFICIENT_SCOPE: "INSUFFICIENT_SCOPE";
    MISSING_CLAIM: "MISSING_CLAIM";
    CRIT_UNSUPPORTED: "CRIT_UNSUPPORTED";
    KEY_NOT_FOUND: "KEY_NOT_FOUND";
    REFRESH_REUSED: "REFRESH_REUSED";
    REVOKED: "REVOKED";
    STORE_ERROR: "STORE_ERROR";
}>;
/**
 * Every recoverable failure raised by this package. Carries a stable
 * `code` (from {@link ErrorCode}) and a `status` — the HTTP response
 * status a middleware layer would use when translating the error.
 */
declare class JwtError extends BaseError {
    static statuses: {
        INVALID_ARGUMENT: number;
        UNSUPPORTED_ALGORITHM: number;
        MISSING_ALG_ALLOWLIST: number;
        INVALID_TOKEN: number;
        INVALID_HEADER: number;
        INVALID_PAYLOAD: number;
        INVALID_SIGNATURE: number;
        INVALID_KEY: number;
        ALGORITHM_MISMATCH: number;
        ALGORITHM_NONE_FORBIDDEN: number;
        CRIT_UNSUPPORTED: number;
        KEY_NOT_FOUND: number;
        TOKEN_EXPIRED: number;
        TOKEN_NOT_YET_VALID: number;
        TOKEN_TOO_OLD: number;
        INVALID_ISSUER: number;
        INVALID_AUDIENCE: number;
        INVALID_SUBJECT: number;
        INVALID_NONCE: number;
        INVALID_TYP: number;
        MISSING_CLAIM: number;
        REFRESH_REUSED: number;
        REVOKED: number;
        INSUFFICIENT_SCOPE: number;
        TOKEN_TOO_LARGE: number;
        STORE_ERROR: number;
    };
}

/**
 * Bundled namespace mirroring the ARCHITECTURE example.
 */
declare const jwt: Readonly<{
    sign: typeof sign;
    verify: typeof verify;
    peek: typeof peek;
    decode: typeof decode;
    decodeProtectedHeader: typeof decodeProtectedHeader;
}>;
type SignOptions = SignOptions$1;
type VerifyOptions = VerifyOptions$1;
type VerifyResult = VerifyResult$1;
type DecodedJwt = DecodedJwt$1;
type ClaimsOptions = ClaimsOptions$2;
type KeyInput = KeyInput$4;
type KeyResolverFn = KeyResolverFn$2;

export { ErrorCode, JwtError, decode, decodeProtectedHeader, jwt, peek, sign, verify };
export type { ClaimsOptions, DecodedJwt, KeyInput, KeyResolverFn, SignOptions, VerifyOptions, VerifyResult };