import type { AuthzContext } from '../context/authz-context';
import { type SigningKey } from './internal-token';
export interface SignerConfig {
    key: SigningKey;
    kid: string;
    /** Subject used when there is no user in context (system/cron calls). */
    systemSubject?: string;
}
export declare class InternalTokenSigner {
    private readonly cfg;
    constructor(cfg: SignerConfig);
    /**
     * Returns a shallow clone of `payload` with `_internalJwt` attached. The `req`
     * body-hash is computed over the payload BEFORE the token is added (DEC-S2.19),
     * so the downstream verifier reproduces it after stripping the field.
     */
    sign(cmd: string, audience: string, payload: Record<string, unknown>, ctx?: AuthzContext): Promise<Record<string, unknown>>;
}
/** `{cmd:'x'}` → 'x'; anything else → stable JSON (EDGE-S2.36). */
export declare function patternToCmd(pattern: unknown): string;
//# sourceMappingURL=internal-token.signer.d.ts.map