export interface InvocationTokenClaims {
    version: 1;
    kid: string;
    deployment: GatewayDeployment;
    audience: string;
    issuer: string;
    webId: string;
    scopes: string[];
    issuedAt: Date;
    expiresAt: Date;
    jti: string;
}
export type GatewayDeployment = 'cloud' | 'local';
export interface InvocationTokenSecret {
    kid: string;
    secret: string;
}
export interface InvocationTokenInput {
    deployment: GatewayDeployment;
    audience: string;
    issuer: string;
    webId: string;
    scopes: string[];
    issuedAt: Date;
    expiresAt: Date;
    jti?: string;
}
export interface InvocationTokenCodec {
    encode(input: InvocationTokenInput): string;
    decode(token: string): InvocationTokenClaims | undefined;
}
export interface AesInvocationTokenCodecOptions {
    active: InvocationTokenSecret;
    previous?: InvocationTokenSecret[];
}
export declare class AesInvocationTokenCodec implements InvocationTokenCodec {
    private readonly active;
    private readonly ring;
    constructor(options: AesInvocationTokenCodecOptions);
    encode(input: InvocationTokenInput): string;
    decode(token: string): InvocationTokenClaims | undefined;
}
export declare function requireCanonicalOrigin(value: string, name?: string): string;
export declare function requireCanonicalWebId(value: string): string;