export interface StytchClaims {
    /** The full decoded JWT payload. */
    raw: Record<string, unknown>;
    /** Member id — the per-user identity (maps to Stytch member_id). */
    memberId: string;
    /** Organization id the member belongs to. */
    organizationId: string;
    /** Granted scopes. */
    scopes: string[];
}
export interface ValidatorConfig {
    /** Stytch JWKS URL for this project. */
    jwksUrl: string;
    /** If set, the token's `iss` must equal this. */
    issuer?: string;
    /** If set, the token's `aud` must include this. */
    audience?: string;
    /** Clock injection (ms epoch). */
    now?: () => number;
    /** fetch injection (tests). */
    fetchImpl?: typeof fetch;
    /** JWKS cache lifetime (ms). Default 1h. */
    jwksCacheMs?: number;
    /** Allowed clock skew for exp/nbf (seconds). Default 30. */
    clockSkewSeconds?: number;
    /** Log decoded claims to stderr (bring-up only). */
    debugClaims?: boolean;
}
export declare class TokenValidationError extends Error {
    constructor(message: string);
}
export interface StytchTokenValidator {
    validate(token: string): Promise<StytchClaims>;
}
export declare function createStytchTokenValidator(cfg: ValidatorConfig): StytchTokenValidator;
//# sourceMappingURL=stytchTokenValidator.d.ts.map