import { RequestHandler } from 'express';
import { SecretValue } from './secure-secret.js';
/**
 * Simple JWT Authentication
 *
 * For 70% of use cases where you don't need full OAuth 2.1 complexity.
 * Perfect for internal tools, APIs, and services that manage their own tokens.
 */
/**
 * Standard JWT claims that are commonly used
 */
export interface StandardJWTClaims {
    /** Subject - typically user ID */
    sub?: string;
    /** Audience - who the token is intended for */
    aud?: string | string[];
    /** Issuer - who created the token */
    iss?: string;
    /** Expiration time (unix timestamp) */
    exp?: number;
    /** Issued at (unix timestamp) */
    iat?: number;
    /** Not before (unix timestamp) */
    nbf?: number;
    /** JWT ID - unique identifier */
    jti?: string;
}
/**
 * Custom claims that can be added to JWT payload
 */
export interface CustomJWTClaims {
    /** User scopes/permissions */
    scopes?: string[];
    /** Space-separated scopes (OAuth style) */
    scope?: string;
    /** Client ID for machine-to-machine auth */
    client_id?: string;
    /** User's email */
    email?: string;
    /** User's name */
    name?: string;
    /** User roles */
    roles?: string[];
}
/**
 * Full JWT payload combining standard and custom claims
 */
export interface JWTPayload extends StandardJWTClaims, CustomJWTClaims {
    /** Allow additional custom claims */
    [key: string]: unknown;
}
export interface SimpleJWTConfig {
    /**
     * JWT secret for signing/verification (HS256)
     *
     * **Recommended:** Use SecretValue.fromEnv() to load from environment
     *
     * @example
     * ```typescript
     * // Recommended: Load from environment
     * import { SecretValue } from '@nitrostack/sdk/auth';
     *
     * const config = {
     *   secret: SecretValue.fromEnv('JWT_SECRET'),
     *   audience: 'my-api',
     * };
     * ```
     */
    secret: SecretValue | string;
    /**
     * Expected audience (who the token is for)
     */
    audience?: string;
    /**
     * Expected issuer (who created the token)
     */
    issuer?: string;
    /**
     * Custom claims to validate
     */
    customValidation?: (payload: JWTPayload) => boolean;
    /**
     * Algorithm (default: HS256)
     */
    algorithm?: 'HS256' | 'HS384' | 'HS512';
}
/**
 * Create Simple JWT authentication middleware
 *
 * @example
 * ```typescript
 * const server = createServer({...});
 *
 * // Simple JWT auth (no OAuth complexity!)
 * server.app.use('/mcp', createSimpleJWTAuth({
 *   secret: process.env.JWT_SECRET!,
 *   audience: 'my-mcp-server',
 *   issuer: 'my-app',
 * }));
 *
 * server.start();
 * ```
 */
export declare function createSimpleJWTAuth(config: SimpleJWTConfig): RequestHandler;
/**
 * Generate a JWT token (helper for testing/development)
 *
 * @example
 * ```typescript
 * const token = generateJWT({
 *   secret: process.env.JWT_SECRET!,
 *   payload: {
 *     sub: 'user123',
 *     scopes: ['mcp:read', 'mcp:write'],
 *   },
 *   expiresIn: '1h',
 * });
 * ```
 */
/**
 * Options for generating a JWT token
 */
export interface GenerateJWTOptions {
    /**
     * JWT secret for signing
     *
     * @example
     * ```typescript
     * secret: SecretValue.fromEnv('JWT_SECRET')
     * // or for testing:
     * secret: SecretValue.fromValue('test-secret', { allowHardcoded: true })
     * ```
     */
    secret: SecretValue | string;
    /** Payload to encode in the JWT */
    payload: JWTPayload;
    /** Token expiration (e.g., '1h', '7d', 3600) */
    expiresIn?: string | number;
    /** Expected audience */
    audience?: string;
    /** Token issuer */
    issuer?: string;
    /** Signing algorithm */
    algorithm?: 'HS256' | 'HS384' | 'HS512';
}
/**
 * Generate a JWT token
 *
 * @example
 * ```typescript
 * const token = generateJWT({
 *   secret: SecretValue.fromEnv('JWT_SECRET'),
 *   payload: {
 *     sub: 'user123',
 *     scopes: ['mcp:read', 'mcp:write'],
 *   },
 *   expiresIn: '1h',
 * });
 * ```
 */
export declare function generateJWT(options: GenerateJWTOptions): string;
/**
 * Verify a JWT token without middleware (helper)
 *
 * @param token - The JWT token to verify
 * @param config - JWT configuration including secret
 * @returns The decoded payload if valid, null otherwise
 */
export declare function verifyJWT(token: string, config: SimpleJWTConfig): JWTPayload | null;
/**
 * Decode JWT without verification (for debugging)
 */
export declare function decodeJWT(token: string): JWTPayload | null;
//# sourceMappingURL=simple-jwt.d.ts.map