import { type IdentityPlugin } from "@nifrajs/core/server";
import { type MaybePromise } from "./_utils.js";
export type JwtAlgorithm = "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512";
export interface JwtHeader {
    readonly alg: string;
    readonly kid?: string;
    readonly typ?: string;
    readonly [key: string]: unknown;
}
export interface JwtClaims {
    readonly iss?: string;
    readonly sub?: string;
    readonly aud?: string | readonly string[];
    readonly exp?: number;
    readonly nbf?: number;
    readonly iat?: number;
    readonly jti?: string;
    readonly [claim: string]: unknown;
}
export interface VerifiedJwt<C extends JwtClaims = JwtClaims> {
    readonly header: JwtHeader;
    readonly claims: C;
    readonly token: string;
}
export type VerifyJwtResult<C extends JwtClaims = JwtClaims> = {
    readonly ok: true;
    readonly data: VerifiedJwt<C>;
} | {
    readonly ok: false;
    readonly error: Error;
};
export interface JwkKey {
    readonly kty?: string;
    readonly kid?: string;
    readonly alg?: string;
    readonly use?: string;
    readonly key_ops?: readonly string[];
    readonly [key: string]: unknown;
}
export type JwtVerificationKey = string | Uint8Array | CryptoKey | JwkKey;
export type JwtKeyResolver = (header: JwtHeader, claims: JwtClaims) => MaybePromise<JwtVerificationKey | null | undefined>;
export interface VerifyJwtOptions {
    readonly key: JwtVerificationKey | JwtKeyResolver;
    readonly algorithms: readonly JwtAlgorithm[];
    readonly issuer?: string | readonly string[];
    readonly audience?: string | readonly string[];
    readonly clockToleranceSec?: number;
    readonly requiredClaims?: readonly string[];
    readonly requireExpiration?: boolean;
    readonly maxAgeSec?: number;
    readonly now?: () => number;
}
export interface JwtOptions extends VerifyJwtOptions {
    readonly realm?: string;
    readonly optional?: boolean;
    /** Header carrying the token. Default `"authorization"` (`Bearer <token>`). */
    readonly header?: string;
    /** Optional cookie fallback carrying the raw token. */
    readonly cookie?: string;
}
export type JwtPlugin<C extends JwtClaims = JwtClaims> = IdentityPlugin & {
    claims(request: Request): C | null;
    requireClaims(request: Request): C;
};
export interface JwksOptions {
    readonly url: string | URL;
    readonly fetch?: typeof fetch;
    readonly cacheMs?: number;
    /**
     * Extra time to keep using the last successful key set when refresh fails.
     * Defaults to one cache window; set `0` to fail closed immediately on refresh errors.
     */
    readonly staleMs?: number;
    readonly timeoutMs?: number;
    readonly maxBytes?: number;
}
export declare function verifyJwt<C extends JwtClaims = JwtClaims>(token: string, options: VerifyJwtOptions): Promise<VerifiedJwt<C>>;
export declare function tryVerifyJwt<C extends JwtClaims = JwtClaims>(token: string, options: VerifyJwtOptions): Promise<VerifyJwtResult<C>>;
export declare function jwt<C extends JwtClaims = JwtClaims>(options: JwtOptions): JwtPlugin<C>;
export declare function jwk(key: JwtVerificationKey): JwtKeyResolver;
export declare function jwks(options: JwksOptions): JwtKeyResolver;
//# sourceMappingURL=jwt.d.ts.map