/**
 * Zero-dependency JWT module using node:crypto.
 * HMAC-SHA256 signing, base64url encoding, timing-safe verification.
 */
export interface JwtClaims {
    sub: string;
    iat: number;
    exp: number;
    jti: string;
    kind?: "bootstrap" | "access";
    sid?: string;
}
/** Generate a 32-byte random secret for HMAC-SHA256 signing. */
export declare function generateSecret(): Buffer;
/** Parse a duration string like "1h", "24h", "7d", "never" into seconds. Returns 0 for "never". */
export declare function parseDuration(str: string): number;
/** Create a JWT signed with HMAC-SHA256. */
export declare function createJwt(secret: Buffer | string, options?: {
    expireSeconds?: number;
    extraClaims?: Partial<Omit<JwtClaims, "sub" | "iat" | "exp" | "jti">>;
}): {
    token: string;
    claims: JwtClaims;
};
/** Verify a JWT. Returns claims on success, null on failure. */
export declare function verifyJwt(secret: Buffer | string, token: string, revokedJtis?: Set<string> | string[]): JwtClaims | null;