/** Options for {@link validateBotFrameworkJwt}. */
export type JwtValidationOptions = {
    /** The Skaile-published multi-tenant Entra app id — the expected `aud`. */
    appId: string;
    /** Default "https://login.botframework.com/v1/.well-known/openidconfiguration". */
    openIdMetadataUrl?: string;
    /** Default 300_000 (5 min). */
    clockSkewMs?: number;
    fetchImpl?: typeof fetch;
    now?: () => number;
};
/** Outcome of {@link validateBotFrameworkJwt} — `reason` is safe to log, never secret. */
export type JwtValidationResult = {
    ok: true;
} | {
    ok: false;
    reason: string;
};
/**
 * Validates a Bot Framework channel→bot JWT (RS256 via the published JWKS):
 * Bearer present, alg RS256, iss "https://api.botframework.com", aud === appId,
 * exp/nbf within skew, serviceurl claim === the activity's serviceUrl.
 * JWKS keys cached in-module by kid for 24h; an unknown kid forces one
 * rate-limited refetch (key rotation) before the token is rejected.
 */
export declare function validateBotFrameworkJwt(authorizationHeader: string | undefined, activityServiceUrl: string, opts: JwtValidationOptions): Promise<JwtValidationResult>;
//# sourceMappingURL=jwt.d.ts.map