//#region src/utils/jwt-helpers.d.ts
/**
 * Get the JWT signing secret from environment variables.
 * Falls back to an insecure default in non-production environments.
 */
declare function getJwtSecret(): Uint8Array;
/**
 * Common verification result structure
 */
interface JwtVerifyResult<T> {
  valid: boolean;
  payload?: T;
  error?: string;
}
/**
 * Options for signing a JWT
 */
interface SignJwtOptions {
  issuer: string;
  subject: string;
  audience?: string;
  expiresIn?: string;
  claims?: Record<string, unknown>;
}
/**
 * Sign a JWT with the shared secret
 */
declare function signJwt(options: SignJwtOptions): Promise<string>;
/**
 * Options for verifying a JWT
 */
interface VerifyJwtOptions {
  issuer: string;
  audience?: string;
}
/**
 * Verify a JWT and return the raw payload
 */
declare function verifyJwt(token: string, options: VerifyJwtOptions): Promise<JwtVerifyResult<Record<string, unknown>>>;
/**
 * Extract bearer token from Authorization header
 */
declare function extractBearerToken(authHeader: string | undefined): {
  token?: string;
  error?: string;
};
/**
 * Decode JWT payload without verification (for checking issuer before full verify)
 */
declare function decodeJwtPayload(token: string): Record<string, unknown> | null;
/**
 * Check if a token has a specific issuer (without full verification)
 */
declare function hasIssuer(token: string, issuer: string): boolean;
/**
 * Derive a deterministic kid from a PEM-encoded public key.
 * The kid is a truncated SHA-256 hash prefixed with 'pg-'.
 */
declare function deriveKidFromPublicKey(publicKeyPem: string): Promise<string>;
//#endregion
export { JwtVerifyResult, SignJwtOptions, VerifyJwtOptions, decodeJwtPayload, deriveKidFromPublicKey, extractBearerToken, getJwtSecret, hasIssuer, signJwt, verifyJwt };