export interface TokenPayload {
    key: string;
    contentType?: string;
    maxSize?: number;
    minSize?: number;
    /**
     * The canonical non-routing query of the request that minted the token
     * (everything but `op`/`key`/`token`, sorted). A per-request `files`
     * factory picks the instance from that query, so the token is only honored
     * by the same instance it was minted for. Absent when the query was empty.
     */
    query?: string;
    /**
     * The URL path of the endpoint that minted the token. Routers mounted at
     * different paths commonly share one secret (`FILES_API_SECRET`), so the
     * token is only honored by the endpoint it was minted at — never by a
     * sibling router whose `authorize` never approved the upload.
     */
    path?: string;
    /**
     * The origin (scheme + host) of the request that minted the token. A
     * per-request `files` factory can pick the tenant's instance from the
     * host, so the token is only honored on the host it was minted on.
     */
    origin?: string;
    /**
     * `"proxy"` when presign handed the client the gateway's own proxy PUT
     * rather than a storage-signed target, so `complete` can tell
     * `onUploadComplete` how the bytes arrived. Absent = direct to storage.
     */
    via?: "proxy";
    /** Expiry, epoch milliseconds. */
    exp: number;
}
export type VerifyResult = {
    ok: true;
    payload: TokenPayload;
} | {
    ok: false;
    failure: "malformed" | "signature" | "expired";
};
export declare const signToken: (payload: TokenPayload, secret: string) => Promise<string>;
/**
 * Verify `token`'s signature and expiry. `graceMs` extends the expiry for a
 * step that may legitimately run after it — `complete`, whose bytes can finish
 * landing after the window the upload started in.
 */
export declare const verifyToken: (token: string, secret: string, now?: number, graceMs?: number) => Promise<VerifyResult>;
//# sourceMappingURL=sign-token.d.ts.map