import { JwtHook } from './AuthHooks';
import { AuthValues } from './AuthConfig';
/**
 * DefaultJwtHook - a batteries-included {@link JwtHook} for the common case: HS256 user JWTs signed
 * with ONE shared secret. Construct it with the secret and bind it — `new DefaultJwtHook(secret)` —
 * and `@AuthJwt` endpoints work with NO custom verification code.
 *
 * `parseJwt` verifies the signature + expiry (jsonwebtoken, HS256 only) and maps standard claims:
 * `sub` → userId, a string[] `roles` claim → roles, the whole payload → claims. `authorizeJwt`
 * (role enforcement) is inherited from JwtHook. For RS256 + JWKS, a provider SDK, or a non-standard
 * payload, write your own JwtHook subclass instead.
 */
export declare class DefaultJwtHook extends JwtHook {
    private readonly secret;
    constructor(secret: string);
    parseJwt(token: string): AuthValues;
    /** Verify HS256 signature + expiry; translate jsonwebtoken's raw error into a framework 401. */
    private verifyToken;
    private extractRoles;
}