/**
 * ext-auth-jwt: AuthProvider implementation backed by `jose`.
 *
 * Provides the `AuthProvider` contract: sign / verify (HS256 by default),
 * remote-JWKS verification, public-key verification, and header decoding.
 *
 * @module extensions/ext-auth-jwt
 */
import "../../../_dnt.polyfills.js";
import { jwtVerify } from "jose";
import type { ExtensionFactory } from "veryfront/extensions";
import type { AuthProvider } from "veryfront/extensions/auth";
/**
 * Signature used by jose's verify step to resolve a key for a given header.
 *
 * Matches the shape returned by `createRemoteJWKSet` / `createLocalJWKSet`
 * and lets tests inject an in-memory key set without reaching the network.
 */
export type JwksResolver = Parameters<typeof jwtVerify>[1] & object;
/**
 * Factory for building a JWKS resolver from a URL.
 *
 * The default uses `createRemoteJWKSet`; tests can inject a stub that returns
 * a local resolver bound to an in-memory key set.
 */
export type JwksResolverFactory = (jwksUrl: string) => JwksResolver;
/**
 * Optional configuration for the ext-auth-jwt factory.
 *
 * - `secret`: HMAC secret for `sign`/`verify`. Falls back to the `JWT_SECRET`
 *   environment variable. Without one, `sign`/`verify` throw.
 * - `jwksResolverFactory`: test seam that overrides JWKS resolution.
 */
export interface ExtJwtConfig {
    secret?: string | Uint8Array;
    jwksResolverFactory?: JwksResolverFactory;
}
declare function createAuthProvider(config: ExtJwtConfig): AuthProvider;
/**
 * Default export — the ext-auth-jwt extension factory.
 *
 * Produces an extension that registers an `AuthProvider` contract
 * implementation backed by `jose`.
 */
declare const extJwt: ExtensionFactory;
export default extJwt;
export { createAuthProvider };
//# sourceMappingURL=index.d.ts.map