type KeyInput$1 = any | Buffer | Uint8Array | string | Record<string, unknown>;

type SignOptions$1 = {
    alg: string;
    expiresIn?: string | number | undefined;
    notBefore?: string | number | undefined;
    issuer?: string | undefined;
    audience?: string | string[] | undefined;
    subject?: string | undefined;
    jwtId?: boolean | {
        size?: number;
        encoding?: string;
    } | (() => string | Promise<string>) | undefined;
    nonce?: string | undefined;
    /**
     * Header `typ`. Default `'JWT'`. `'at+jwt'` for RFC 9068.
     */
    typ?: string | undefined;
    kid?: string | undefined;
    header?: Record<string, unknown> | undefined;
    noTimestamp?: boolean | undefined;
    returnMetadata?: boolean | undefined;
};

type StoreRecord = {
    expiresAt: number;
    metadata?: Record<string, unknown> | undefined;
};
type MarkUsedResult = {
    /**
     * true if this call stamped usedAt (was null before)
     */
    swapped: boolean;
    /**
     * the record after the operation
     */
    record: StoreRecord;
};
type Store$1 = {
    add: (key: string, expiresAt: number, metadata?: Record<string, unknown>) => Promise<void>;
    has: (key: string) => Promise<boolean>;
    get: (key: string) => Promise<StoreRecord | null>;
    delete: (key: string) => Promise<void>;
    deleteAll: (filter: Record<string, unknown>) => Promise<number>;
    markUsed?: ((key: string, nowSec: number) => Promise<MarkUsedResult | null>) | undefined;
    size: () => number;
    _stop: () => void;
};

/**
 * @typedef {import('./internal/keys.js').KeyInput} KeyInput
 * @typedef {import('./internal/memory-store.js').Store} Store
 * @typedef {import('./sign.js').SignOptions} SignOptions
 *
 * @typedef {Object} RefreshOptions
 * @property {string} [alg]                                              Alg for signed refresh (opaque:false). Ignored — and no longer required — on the opaque default path.
 * @property {string | number} expiresIn                                 REQUIRED.
 * @property {boolean} [opaque]                                          Default true — random string. false → signed JWT refresh.
 * @property {number} [tokenSize]                                        Default 32 bytes.
 * @property {string} [encoding]                                         'base64url' | 'base64' | 'hex' | 'crockford' | 'uuid'.
 * @property {string} [hashAlgo]                                         Built-in: 'sha256' | 'sha384' | 'sha512'.
 * @property {(pt: string) => string | Promise<string>} [hashFn]         Custom override — wins over hashAlgo.
 * @property {() => Promise<{ plaintext: string, storeKey: string }>} [generate]  Custom generator — wins over hashFn.
 * @property {Store} store                                               REQUIRED.
 *
 * @typedef {Object} SecretPair
 * @property {KeyInput} access
 * @property {KeyInput} refresh
 *
 * @typedef {Object} CreateOptions
 * @property {SecretPair} secret
 * @property {SignOptions} access
 * @property {RefreshOptions} refresh
 * @property {string} [familyId]
 *
 * @typedef {Object} CreateResult
 * @property {string} accessToken
 * @property {string} refreshToken
 * @property {Date} accessExpiresAt
 * @property {Date} refreshExpiresAt
 * @property {string} familyId
 *
 * @typedef {Object} RotateOptions
 * @property {SecretPair} secret
 * @property {SignOptions} access
 * @property {RefreshOptions} refresh
 * @property {boolean} [detectReuse]                                     Default true.
 * @property {number | string} [reuseWindow]                             ms grace for network races. Default 0.
 * @property {Record<string, unknown>} [payload]                         Override stored payload for the new access token.
 *
 * @typedef {Object} RevokeOptions
 * @property {Store} store
 * @property {string} [hashAlgo]
 * @property {(pt: string) => string | Promise<string>} [hashFn]
 */
/**
 * @param {Record<string, unknown>} payload
 * @param {CreateOptions} options
 * @returns {Promise<CreateResult>}
 */
declare function create(payload: Record<string, unknown>, options: CreateOptions): Promise<CreateResult>;
/**
 * Rotate a refresh token — issues a new access + refresh pair and
 * marks the old refresh as consumed. Second use of the same refresh
 * (outside the network-race grace window) triggers reuse detection:
 * the entire family (every refresh with the same `familyId`) is
 * revoked and `REFRESH_REUSED` raised.
 *
 * Concurrent rotations of the *same* refresh token are serialised.
 * Built-in stores (memory + redis) expose an atomic `markUsed()`
 * that stamps `usedAt` via compare-and-swap (Lua script on Redis),
 * making this safe across processes. Custom stores without `markUsed`
 * fall back to the in-process per-key mutex.
 *
 * @param {string} oldRefreshToken
 * @param {RotateOptions} options
 * @returns {Promise<CreateResult>}
 */
declare function rotate(oldRefreshToken: string, options: RotateOptions): Promise<CreateResult>;
/**
 * @param {string} refreshToken
 * @param {RevokeOptions} options
 * @returns {Promise<void>}
 */
declare function revoke(refreshToken: string, options: RevokeOptions): Promise<void>;
/**
 * @param {string} familyId
 * @param {{ store: Store }} options
 * @returns {Promise<number>}   count of revoked records
 */
declare function revokeAll(familyId: string, options: {
    store: Store;
}): Promise<number>;
/**
 * Bundled namespace matching the ARCHITECTURE example.
 */
declare const tokenPair: Readonly<{
    create: typeof create;
    rotate: typeof rotate;
    revoke: typeof revoke;
    revokeAll: typeof revokeAll;
}>;
type KeyInput = KeyInput$1;
type Store = Store$1;
type SignOptions = SignOptions$1;
type RefreshOptions = {
    /**
     * Alg for signed refresh (opaque:false). Ignored — and no longer required — on the opaque default path.
     */
    alg?: string | undefined;
    /**
     * REQUIRED.
     */
    expiresIn: string | number;
    /**
     * Default true — random string. false → signed JWT refresh.
     */
    opaque?: boolean | undefined;
    /**
     * Default 32 bytes.
     */
    tokenSize?: number | undefined;
    /**
     * 'base64url' | 'base64' | 'hex' | 'crockford' | 'uuid'.
     */
    encoding?: string | undefined;
    /**
     * Built-in: 'sha256' | 'sha384' | 'sha512'.
     */
    hashAlgo?: string | undefined;
    /**
     * Custom override — wins over hashAlgo.
     */
    hashFn?: ((pt: string) => string | Promise<string>) | undefined;
    /**
     * Custom generator — wins over hashFn.
     */
    generate?: (() => Promise<{
        plaintext: string;
        storeKey: string;
    }>) | undefined;
    /**
     * REQUIRED.
     */
    store: Store;
};
type SecretPair = {
    access: KeyInput;
    refresh: KeyInput;
};
type CreateOptions = {
    secret: SecretPair;
    access: SignOptions;
    refresh: RefreshOptions;
    familyId?: string | undefined;
};
type CreateResult = {
    accessToken: string;
    refreshToken: string;
    accessExpiresAt: Date;
    refreshExpiresAt: Date;
    familyId: string;
};
type RotateOptions = {
    secret: SecretPair;
    access: SignOptions;
    refresh: RefreshOptions;
    /**
     * Default true.
     */
    detectReuse?: boolean | undefined;
    /**
     * ms grace for network races. Default 0.
     */
    reuseWindow?: string | number | undefined;
    /**
     * Override stored payload for the new access token.
     */
    payload?: Record<string, unknown> | undefined;
};
type RevokeOptions = {
    store: Store;
    hashAlgo?: string | undefined;
    hashFn?: ((pt: string) => string | Promise<string>) | undefined;
};

export { create, revoke, revokeAll, rotate, tokenPair };
export type { CreateOptions, CreateResult, KeyInput, RefreshOptions, RevokeOptions, RotateOptions, SecretPair, SignOptions, Store };