/**
 * JWT Authentication Module
 * Implements secure token issuance and validation with HTTP-only cookies
 */
import type { TokenPayload, AuthCookieConfig } from '../types.js';
/**
 * Sign a JWT token for a user
 * @param subOrgId - Turnkey sub-organization ID (stable identifier)
 * @param email - User email (metadata)
 * @param sessionToken - Optional Turnkey session token for user authentication
 * @param options - Additional options
 * @returns Signed JWT token string
 */
export declare function signToken(subOrgId: string, email: string, sessionToken?: string, options?: {
    secret?: string;
    expiresIn?: number;
    issuer?: string;
    audience?: string;
}): string;
/**
 * Verify and decode a JWT token
 * @param token - JWT token string
 * @param options - Additional options
 * @returns Decoded token payload
 * @throws Error if token is invalid or expired
 */
export declare function verifyToken(token: string, options?: {
    secret?: string;
    issuer?: string;
    audience?: string;
}): TokenPayload;
/**
 * Generate a secure cookie configuration for authentication tokens
 * @param token - JWT token to set in cookie
 * @param options - Cookie options
 * @returns Cookie configuration object
 */
export declare function getAuthCookieConfig(token: string, options?: {
    cookieName?: string;
    maxAge?: number;
    secure?: boolean;
}): AuthCookieConfig;
/**
 * Get cookie configuration for logout (clears the auth cookie)
 *
 * `secure` mirrors getAuthCookieConfig: a clear that drops the flag would be
 * sent — and could be intercepted — over a channel the original never used, so
 * a deployment that pins `secure: true` on the set must pin it here too.
 * @param cookieName - Name of the cookie to clear
 * @param options - Cookie options; `secure` defaults to NODE_ENV === 'production'
 * @returns Cookie configuration for clearing
 */
export declare function getClearAuthCookieConfig(cookieName?: string, options?: {
    secure?: boolean;
}): AuthCookieConfig;
//# sourceMappingURL=jwt.d.ts.map