import type { PermissionGrant, Principal } from "../../core/index.js";
type Awaitable<T> = T | Promise<T>;
export type SecretSource = string | (() => Awaitable<string | undefined>);
export type JwtClaims = Record<string, unknown>;
export type ClaimsResolver = (principal: Principal, grant: PermissionGrant) => Awaitable<JwtClaims | null>;
export type ClaimsOption = JwtClaims | ClaimsResolver;
export declare class TokenCache {
    #private;
    get size(): number;
    get(key: string, nowMs: number, safetyMs: number): string | undefined;
    set(key: string, token: string, expiresAtMs: number, nowMs: number): void;
}
export declare function assertLifetime(expiresInSeconds: number, cacheSafetySeconds: number): void;
export declare function resolveSecret(source: SecretSource | undefined, fallbackEnvironmentName?: string): Promise<string | undefined>;
export declare function resolveClaims(option: ClaimsOption | undefined, principal: Principal, grant: PermissionGrant): Promise<JwtClaims | null>;
export declare function stableJson(value: unknown): string;
export declare function secretFingerprint(secret: string): Promise<string>;
export declare function signHs256(payload: JwtClaims, secret: string, header?: JwtClaims): Promise<string>;
export interface VerifyHs256Options {
    nowSeconds?: number;
    issuer?: string;
    audience?: string;
    type?: string;
}
export declare function verifyHs256(token: string, secret: string, options?: VerifyHs256Options): Promise<{
    header: JwtClaims;
    payload: JwtClaims;
}>;
export {};