import type { Middleware } from "../types/http.js";
import type { JWTAuthOptions } from "./types.js";
/**
 * Creates a middleware function for handling JWT authentication in HTTP requests.
 *
 * This middleware extracts a JWT from the specified HTTP header, verifies or decodes it,
 * and attaches the decoded payload to the context. It supports configurable options such as
 * the secret key, algorithm, header name, authentication scheme, and error handling.
 *
 * @param options - Configuration options for JWT authentication.
 * @returns A middleware function that processes JWT authentication for incoming requests.
 *
 * @remarks
 * - If `decodeOnly` is true, the JWT is only decoded and not verified.
 * - If `required` is true, requests without a valid JWT will be rejected with a 401 status.
 * - If `onError` is provided, it will be called on authentication errors.
 *
 * @example
 * ```typescript
 * app.use(jwtMiddleware({ secret: "mysecret" }));
 * ```
 */
export declare function jwtMiddleware(options: JWTAuthOptions): Middleware;
/**
 * Signs a JSON Web Token (JWT) with the given payload and secret.
 *
 * @param payload - The payload to include in the JWT. Should be a plain object.
 * @param secret - The secret key used to sign the JWT.
 * @param expiresIn - Optional. The expiration time for the token (e.g., "1h", "30m"). Defaults to "1h".
 * @returns The signed JWT as a string.
 *
 * @remarks
 * The function uses the HS256 algorithm to sign the token. The `iat` (issued at) and `exp` (expiration) claims
 * are automatically added to the payload based on the current time and the `expiresIn` parameter.
 */
export declare function signJWT(payload: Record<string, any>, secret: string, expiresIn?: string): string;
/**
 * Decodes and verifies a JSON Web Token (JWT) using the provided secret.
 *
 * This function splits the JWT into its header, payload, and signature components,
 * verifies the signature using HMAC SHA-256 and the provided secret, and checks
 * the token's expiration (if present). If the token is valid and not expired,
 * it returns the decoded payload as an object. Otherwise, it returns `null`.
 *
 * @param token - The JWT string to decode and verify.
 * @param secret - The secret key used to verify the token's signature.
 * @returns The decoded payload as a record if the token is valid, or `null` if invalid or expired.
 */
export declare function decodeJWT(token: string, secret: string): Record<string, any> | null;
//# sourceMappingURL=jwt.d.ts.map