/**
 * Mints a short-lived JWT asserting the current user's identity, signed by the host's
 * own backend. Sent as the bearer credential on `/fiat/*` requests, which is
 * where it is verified — nothing here trusts its claims.
 */
export type GetIdentityAssertion = () => Promise<string>;
export interface IdentityAssertionProvider {
    /** Returns a fresh or cached assertion. */
    get(): Promise<string>;
    /** Clears an assertion the server rejected. */
    invalidate(): void;
}
/**
 * Caches an assertion until shortly before it expires.
 *
 * The `exp` claim is read for one purpose, scheduling the refresh. A host that
 * breaks the JWT contract is tolerated rather than trusted: an unreadable
 * expiry falls back to a short TTL, so the flow keeps working and the cost is
 * only a more frequent mint.
 */
export declare function createIdentityAssertionProvider(mint: GetIdentityAssertion, now?: () => number): IdentityAssertionProvider;
/** Reads `exp` only to schedule refresh; the backend still verifies the token. */
export declare function readExpSeconds(jwt: string): number | undefined;
/** A JWT's claim set, or `undefined` if it is not a readable JWT. */
export declare function decodeJwtClaims(jwt: string): Record<string, unknown> | undefined;
//# sourceMappingURL=identityAssertion.d.ts.map