import { z } from "zod";
declare const JwtPayloadSchema: z.ZodObject<{
    sub: z.ZodString;
    exp: z.ZodNumber;
    org: z.ZodString;
    project: z.ZodString;
}, z.core.$loose>;
export type JwtPayload = z.infer<typeof JwtPayloadSchema>;
export type JwtFailureReason = 
/** Not a JWT we issued: wrong number of segments, bad header, or a payload that is not a Val payload. */
"malformed"
/** The HMAC did not match: the token was forged or tampered with. */
 | "invalid-signature"
/** The token parsed and verified, but `exp` is in the past. */
 | "expired"
/** Programming error: {@link verifyJwt} was called without a secret. */
 | "missing-secret";
export type JwtFailure = {
    success: false;
    reason: JwtFailureReason;
    message: string;
};
export type JwtResult = {
    success: true;
    data: JwtPayload;
} | JwtFailure;
/**
 * Verify a JWT that we issued with {@link encodeJwt}, and return its payload.
 *
 * Checks, in order: the segment count, the header (`alg` is pinned to HS256, so
 * algorithm confusion is rejected before the signature is looked at), the HMAC
 * (compared in constant time), the payload shape, and `exp`.
 *
 * There is deliberately no way to make this skip the signature check: the
 * secret is required, and an empty one is a failure rather than a token that
 * validates against `HMAC("")`. Use {@link decodeJwtWithoutVerifying} - and read
 * what it says - when you genuinely do not hold the signing key.
 */
export declare function verifyJwt(token: string, secretKey: string): JwtResult;
/**
 * Parse a JWT's payload **without checking its signature**.
 *
 * The header, the payload shape and `exp` are still validated, but nothing here
 * establishes that the token was issued by anyone in particular. Only use this
 * for a token whose authenticity is already established by the channel it
 * arrived on - the app token we fetch from val.build over an api-key
 * authenticated HTTPS request is the one such case. Anything that arrives from
 * a browser (a cookie, a header, a query parameter) must go through
 * {@link verifyJwt}.
 */
export declare function decodeJwtWithoutVerifying(token: string): JwtResult;
export declare function getExpire(): number;
export declare function encodeJwt(payload: object, sessionKey: string): string;
export {};