import type { SignedUrlOptions } from './types';
/**
 * Mint a signed token for the given storage path.
 *
 * @example
 * ```ts
 * const token = createSignedStorageToken('reports/q4.pdf', { expiresIn: 3600 })
 * ```
 */
export declare function createSignedStorageToken(path: string, options: SignedUrlOptions): string;
/**
 * Revoke a signed storage token so subsequent
 * {@link verifySignedStorageToken} calls return
 * `{ valid: false, reason: 'revoked' }`. Idempotent — calling
 * twice is a no-op.
 *
 * Pass either the full JWS compact-form token or just the signature
 * segment (the part after the second `.`); both work because
 * verification keys off the signature segment.
 *
 * @example
 * ```ts
 * const url = await Storage.disk('local').signedUrl('reports/q4.pdf', { expiresIn: 3600 })
 * // ... url is shared, then later leaked
 * revokeSignedStorageToken(extractTokenFromUrl(url))
 * // Any further fetch with that URL → 403
 * ```
 */
export declare function revokeSignedStorageToken(token: string): void;
/**
 * Check whether a signature has been revoked. Exposed for tests
 * and for distributed-cache replicators that need to peek at the
 * set; production callers should rely on {@link verifySignedStorageToken}
 * to consult this automatically.
 */
export declare function isSignedStorageTokenRevoked(sigPart: string): boolean;
/**
 * Test-only: clear the revocation set. The set is process-local
 * and unbounded across tests would let one test's revoke bleed
 * into another's verification.
 */
export declare function clearRevokedSignedStorageTokens(): void;
/**
 * Verify a signed storage token. The caller MUST pass the requested
 * path so we can ensure the token's `path` claim matches what the
 * client is trying to fetch — otherwise an attacker could substitute
 * any path in the URL and still pass signature verification.
 *
 * @example
 * ```ts
 * const v = verifySignedStorageToken(req.query.token, requestedPath)
 * if (!v.valid) return new Response('Forbidden', { status: 403 })
 * ```
 */
export declare function verifySignedStorageToken(token: string, requestedPath: string): SignedTokenVerification;
declare interface SignedTokenClaims {
  iss: string
  iat: number
  exp: number
  path: string
}
/**
 * Result of verifying a signed token.
 */
export declare interface SignedTokenVerification {
  valid: boolean
  reason?: 'malformed' | 'bad_signature' | 'expired' | 'path_mismatch' | 'revoked'
  claims?: SignedTokenClaims
}