import { JwtPayload } from 'jwt-decode';
import { CallerType } from './caller.js';
import { IToken } from './token.js';

type JsonWebTokenPayload = JwtPayload & {
    readonly [key: string]: any;
};
declare class JsonWebToken implements IToken {
    get audience(): string | string[] | undefined;
    get issuer(): string | undefined;
    get keyId(): string | undefined;
    get appId(): string;
    get appDisplayName(): string | undefined;
    get tenantId(): string | undefined;
    get version(): string | undefined;
    get serviceUrl(): string;
    get from(): CallerType;
    get fromId(): string;
    get expiration(): number | undefined;
    private readonly _value;
    private readonly _payload;
    /**
     * Typed accessor for an already-validated JWT payload. This constructor
     * performs no signature verification, no issuer/audience checks, and no
     * expiry enforcement. Constructing it from an untrusted token does NOT
     * establish trust in the contained claims.
     *
     * Signature verification happens at the HTTP trust boundary via
     * `JwtValidator.validateAccessToken` (packages/apps/src/middleware/auth/
     * jwt-validator.ts). Internal callers may also construct from tokens
     * sourced from trusted identity infrastructure (MSAL, Bot Framework API
     * responses).
     *
     * Callers must not construct this class from raw network input.
     */
    constructor(value: string);
    isExpired(bufferMs?: number): boolean;
    toString(): string;
}

export { JsonWebToken, type JsonWebTokenPayload };