export interface JwtConfig {
    secret: string;
    accessExpiresIn?: string;
    refreshExpiresIn?: string;
}
export interface AccessTokenPayload {
    userId: string;
    roles: string[];
    uid?: string;
    /** Authentication Assurance Level: aal1 = password/oauth, aal2 = MFA verified */
    aal?: "aal1" | "aal2";
    /** Email claim from the JWT, if present */
    email?: string;
    /** Display name claim from the JWT, if present */
    displayName?: string;
    /** Photo URL claim from the JWT, if present */
    photoURL?: string;
    /** Whether MFA has been verified for this session */
    mfa_verified?: boolean;
    /** Authentication Methods Reference — list of methods used (e.g. 'pwd', 'otp') */
    amr?: string[];
}
/**
 * Configure JWT settings - call this during initialization.
 * Validates the secret strength to prevent deployment with default/weak secrets.
 */
export declare function configureJwt(config: JwtConfig): void;
/**
 * Generate an access token (short-lived, 1 hour by default)
 */
export declare function generateAccessToken(userId: string, roles: string[], aal?: "aal1" | "aal2", customClaims?: Record<string, unknown>): string;
/**
 * Get the expiration time of an access token in milliseconds from now
 */
export declare function getAccessTokenExpiryMs(): number;
/**
 * Get the expiration timestamp for an access token
 */
export declare function getAccessTokenExpiry(): number;
/**
 * Verify and decode an access token
 */
export declare function verifyAccessToken(token: string): AccessTokenPayload | null;
/**
 * Generate a random refresh token (long-lived, 30 days by default)
 */
export declare function generateRefreshToken(): string;
/**
 * Hash a refresh token for database storage (don't store raw tokens)
 */
export declare function hashRefreshToken(token: string): string;
/**
 * Calculate refresh token expiration date
 */
export declare function getRefreshTokenExpiry(): Date;
export interface DownloadTokenPayload {
    purpose: "file-read";
    path: string;
}
/**
 * Generate a short-lived download token scoped to a specific file path or prefix
 */
export declare function generateDownloadToken(path: string, expiresInSeconds?: number): string;
/**
 * Verify and decode a download token
 */
export declare function verifyDownloadToken(token: string): DownloadTokenPayload | null;