import type { ActAs } from "../../core/index.js";
import { type ClaimsOption, type SecretSource } from "./shared.js";
export type AwayTokenProvider = "clerk" | "auth0";
export interface AwayTokenClaims extends Record<string, unknown> {
    iss: string;
    aud: string;
    sub: string;
    provider: AwayTokenProvider;
    grantId: string;
    tool: string;
    iat: number;
    exp: number;
}
export interface AwayTokenPresetOptions {
    /** A host-owned secret shared by the producer and verifier. Defaults to VENDO_AWAY_TOKEN_SECRET. */
    secret?: SecretSource;
    issuer?: string;
    audience?: string;
    claims?: ClaimsOption;
    expiresInSeconds?: number;
    cacheSafetySeconds?: number;
}
export interface ExpressAwayTokenRequest {
    headers: Record<string, string | string[] | undefined>;
    vendoAwayToken?: AwayTokenClaims;
}
export interface ExpressAwayTokenResponse {
    status(code: number): ExpressAwayTokenResponse;
    json(body: unknown): unknown;
}
export type ExpressAwayTokenMiddleware = (request: ExpressAwayTokenRequest, response: ExpressAwayTokenResponse, next: () => void) => Promise<void>;
export interface AwayTokenPreset {
    actAs: ActAs;
    /** Verify either the compact token or its complete `VendoAway ...` header value. */
    verify(tokenOrAuthorization: string): Promise<AwayTokenClaims>;
    /** Next.js middleware.ts-compatible verifier; mount it on the host API matcher. */
    nextMiddleware(request: Request): Promise<Response>;
    /** Express middleware that attaches verified claims to req.vendoAwayToken. */
    expressMiddleware: ExpressAwayTokenMiddleware;
}
/** Clerk cannot mint provider RS256 sessions offline, so this uses a host-owned away-token. */
export declare function clerkPreset(options?: AwayTokenPresetOptions): AwayTokenPreset;
/** Auth0 cannot mint provider RS256 sessions offline, so this uses a host-owned away-token. */
export declare function auth0Preset(options?: AwayTokenPresetOptions): AwayTokenPreset;