local-lite 0.0.19 → 0.0.20

package/README.md

@@ -92,7 +92,11 @@ This recovers sync state; it does not repair corrupt SQLite files or cancel hung
 * **🔄 Infinite-Loop Safe:** Incoming remote deltas update local tables and fire reactive UI listeners without echoing back into the outbox.
 * **☁️ Database Backups:** Export and restore SQLite snapshots independently of your live sync backend.
 * **🔑 Google Sign-In Out of the Box:** Secure, zero-backend Google OAuth 2.0 (PKCE) authentication with automatic token refresh, user profile retrieval, persistent session storage, and `useGoogleAuth()` hook.
-* **📨 Action Outbox & Email Queue:** Enqueue transactional emails, push notifications, and webhooks offline with idempotency keys, automatic retry backoff, crash recovery, and TTL expiration.
+* **📨 Action Outbox & Email Queue:** Enqueue transactional emails, push notifications, and webhooks offline with idempotency keys, automatic retry backoff, crash recovery, and TTL expiration.
+* **⚡ Fast Key-Value & Encrypted Preferences (`client.kv`):** Typed storage, TTL expiration, and AES-256-GCM zero-knowledge secret protection.
+* **🔍 Instant Full-Text Search (`client.search`):** SQLite FTS5 indexer with prefix matching, BM25 rank scoring, and highlighting.
+* **📁 Offline Media & Blob Storage (`client.storage`):** Decoupled binary attachments, SHA-256 verification, and cloud sync queue (S3/Supabase/Firebase).
+* **⏰ Offline Job Scheduler & Background Cron (`client.scheduler`):** Persistent background task runner supporting human schedules and 5-field cron.
 
 
 ---

package/dist/actions/store.js

@@ -169,7 +169,7 @@ class ActionStore {
      * Cancels a pending action if it has not yet executed.
      */
     static async cancel(db, tableName = exports.DEFAULT_ACTIONS_TABLE, id) {
-        const rows = await db.execute(`UPDATE ${tableName} SET status = 'CANCELLED' WHERE id = ? AND status = 'PENDING';`, [id]);
+        await db.execute(`UPDATE ${tableName} SET status = 'CANCELLED' WHERE id = ? AND status = 'PENDING';`, [id]);
         // In drivers that return affected rows or execute successfully
         const record = await this.findById(db, tableName, id);
         return record?.status === 'CANCELLED';

package/dist/core/client.d.ts

@@ -10,6 +10,11 @@ import { QueryBuilder, AggregateSpec, AggregateResult } from './query-builder.js
 import { type ExportJsonOptions, type ImportJsonOptions, type ExportCsvOptions, type ImportCsvOptions, type ImportSummary } from '../utils/portability.js';
 import { type BackupStorage, type CreateDatabaseBackupOptions, type EncryptedBackupOptions, type RestoreEncryptedBackupOptions } from '../backups/index.js';
 import { ActionManager, type ActionManagerOptions } from '../actions/index.js';
+import { ApiKeyManager, type ApiKeyManagerOptions } from '../keys/index.js';
+import { KVManager, type KVStoreOptions } from '../kv/index.js';
+import { SearchManager } from '../search/index.js';
+import { BlobStorageManager, type BlobStorageManagerOptions } from '../storage/index.js';
+import { JobScheduler, type JobSchedulerOptions } from '../scheduler/index.js';
 export interface LocalFirstClientConfig {
     local: LocalDBAdapter;
     remote: RemoteDBAdapter;
@@ -41,6 +46,10 @@ export interface LocalFirstClientConfig {
      */
     touchUpdatedAt?: boolean | string;
     actions?: ActionManagerOptions;
+    keys?: ApiKeyManagerOptions;
+    kv?: KVStoreOptions;
+    storage?: BlobStorageManagerOptions;
+    scheduler?: JobSchedulerOptions;
 }
 export declare class TransactionalClient {
     private parent;
@@ -89,6 +98,11 @@ export declare class LocalFirstClient {
     touchColumn: string | null;
     readonly maintenance: DatabaseMaintenance;
     readonly actions: ActionManager;
+    readonly keys: ApiKeyManager;
+    readonly kv: KVManager;
+    readonly search: SearchManager;
+    readonly storage: BlobStorageManager;
+    readonly scheduler: JobScheduler;
     private primaryKey;
     private migrations;
     private autoStart;
@@ -328,6 +342,7 @@ export declare class LocalFirstClient {
      */
     reset(options?: {
         dropTables?: boolean;
+        includeInternal?: boolean;
     }): Promise<void>;
     private getAllTableNames;
     /**

package/dist/core/client.js

@@ -15,6 +15,11 @@ const query_builder_js_1 = require("./query-builder.js");
 const portability_js_1 = require("../utils/portability.js");
 const index_js_1 = require("../backups/index.js");
 const index_js_2 = require("../actions/index.js");
+const index_js_3 = require("../keys/index.js");
+const index_js_4 = require("../kv/index.js");
+const index_js_5 = require("../search/index.js");
+const index_js_6 = require("../storage/index.js");
+const index_js_7 = require("../scheduler/index.js");
 function hasFunctionFilter(value) {
     if (typeof value === 'function')
         return true;
@@ -168,6 +173,11 @@ class LocalFirstClient {
     touchColumn;
     maintenance;
     actions;
+    keys;
+    kv;
+    search;
+    storage;
+    scheduler;
     primaryKey;
     migrations;
     autoStart;
@@ -192,8 +202,24 @@ class LocalFirstClient {
                     ? touch
                     : this.remote?.updatedAtColumn || 'updated_at';
         this.schemaManager = new schema_manager_js_1.SchemaManager();
-        this.maintenance = new maintenance_js_1.DatabaseMaintenance(this.db, () => this.tables);
+        this.maintenance = new maintenance_js_1.DatabaseMaintenance(this.db, () => [
+            ...this.tables,
+            '_local_kv',
+            '_local_blobs',
+            '_local_scheduled_jobs',
+            '_local_job_runs',
+            '_local_api_keys',
+            '_local_actions',
+        ]);
         const actionNetwork = config.actions?.network ?? config.network;
+        this.keys = new index_js_3.ApiKeyManager(this.db, config.keys);
+        this.kv = new index_js_4.KVManager(this.db, this.events, config.kv);
+        this.search = new index_js_5.SearchManager(this.db, this.events, (table, id) => this.findById(table, id));
+        this.storage = new index_js_6.BlobStorageManager(this.db, {
+            network: config.network,
+            ...config.storage,
+        });
+        this.scheduler = new index_js_7.JobScheduler(this.db, config.scheduler);
         this.actions = new index_js_2.ActionManager(this.db, this.events, () => Promise.resolve(actionNetwork ? actionNetwork.isOnline() : true), {
             network: actionNetwork,
             ...config.actions,
@@ -357,6 +383,10 @@ class LocalFirstClient {
         await meta_store_js_1.MetaStore.ensureSchema(this.db);
         await outbox_store_js_1.OutboxStore.resetStaleProcessing(this.db);
         await this.actions.initialize();
+        await this.keys.initialize();
+        await this.kv.initialize();
+        await this.storage.initialize();
+        await this.scheduler.initialize();
         if (this.migrations.length > 0) {
             await this.db.transaction(async (tx) => {
                 for (const query of this.migrations) {
@@ -871,6 +901,7 @@ class LocalFirstClient {
     stop() {
         this.syncWorker.stop();
         this.actions.stop();
+        this.scheduler.stop();
     }
     /**
      * Stops background sync workers, cleans up remote listeners,
@@ -891,7 +922,20 @@ class LocalFirstClient {
      */
     async reset(options = {}) {
         this.stop();
-        const tablesToReset = Array.from(new Set([...this.tables, 'sync_outbox', 'sync_meta']));
+        const internalTables = [
+            '_local_kv',
+            '_local_blobs',
+            '_local_scheduled_jobs',
+            '_local_job_runs',
+            '_local_api_keys',
+            '_local_actions',
+        ];
+        const tablesToReset = Array.from(new Set([
+            ...this.tables,
+            'sync_outbox',
+            'sync_meta',
+            ...(options.includeInternal ? internalTables : []),
+        ]));
         for (const table of tablesToReset) {
             try {
                 if (options.dropTables) {

package/dist/index.d.ts

@@ -23,3 +23,8 @@ export * from './schema/index.js';
 export * from './auth/index.js';
 export * from './backups/index.js';
 export * from './actions/index.js';
+export * from './keys/index.js';
+export * from './kv/index.js';
+export * from './search/index.js';
+export * from './storage/index.js';
+export * from './scheduler/index.js';

package/dist/index.js

@@ -39,3 +39,8 @@ __exportStar(require("./schema/index.js"), exports);
 __exportStar(require("./auth/index.js"), exports);
 __exportStar(require("./backups/index.js"), exports);
 __exportStar(require("./actions/index.js"), exports);
+__exportStar(require("./keys/index.js"), exports);
+__exportStar(require("./kv/index.js"), exports);
+__exportStar(require("./search/index.js"), exports);
+__exportStar(require("./storage/index.js"), exports);
+__exportStar(require("./scheduler/index.js"), exports);

package/dist/keys/generator.d.ts

@@ -0,0 +1,38 @@
+import { GenerateApiKeyOptions, GeneratedApiKey } from './types.js';
+/**
+ * Generates cryptographically secure random bytes across Web, Expo/React Native, and Node.js.
+ */
+export declare function getRandomBytes(length: number): Uint8Array;
+/**
+ * Encodes raw bytes into a base62 string.
+ */
+export declare function bytesToBase62(bytes: Uint8Array): string;
+/**
+ * Calculates a 4-byte (8-char hex) checksum over the prefix and random entropy.
+ */
+export declare function calculateKeyChecksum(content: string): string;
+/**
+ * Constant-time string comparison to prevent timing attacks.
+ */
+export declare function timingSafeEqual(a: string, b: string): boolean;
+/**
+ * Hashes an API key using SHA-256 for secure storage.
+ */
+export declare function hashApiKey(key: string): string;
+/**
+ * Generates an industry-standard, cryptographically secure API key.
+ * Format: [prefix]_[entropy]_[checksum]
+ *
+ * Example:
+ * prop_a7F9x2K1m8P0qW4z_c4f910e2
+ */
+export declare function generateApiKey(options?: GenerateApiKeyOptions): GeneratedApiKey;
+/**
+ * Verifies whether a key string is syntactically valid and has an authentic checksum.
+ * Does not require a database lookup.
+ */
+export declare function verifyApiKeyFormat(key: string, expectedPrefix?: string): boolean;
+/**
+ * Validates a raw API key against a stored SHA-256 hash in constant time.
+ */
+export declare function verifyApiKey(rawKey: string, storedHash: string, expectedPrefix?: string): boolean;

package/dist/keys/generator.js

@@ -0,0 +1,136 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getRandomBytes = getRandomBytes;
+exports.bytesToBase62 = bytesToBase62;
+exports.calculateKeyChecksum = calculateKeyChecksum;
+exports.timingSafeEqual = timingSafeEqual;
+exports.hashApiKey = hashApiKey;
+exports.generateApiKey = generateApiKey;
+exports.verifyApiKeyFormat = verifyApiKeyFormat;
+exports.verifyApiKey = verifyApiKey;
+const sha2_js_1 = require("@noble/hashes/sha2.js");
+const utils_js_1 = require("@noble/hashes/utils.js");
+const BASE62_ALPHABET = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
+/**
+ * Generates cryptographically secure random bytes across Web, Expo/React Native, and Node.js.
+ */
+function getRandomBytes(length) {
+    const cryptoObj = globalThis.crypto;
+    if (cryptoObj?.getRandomValues) {
+        return cryptoObj.getRandomValues(new Uint8Array(length));
+    }
+    try {
+        // Dynamic fallback for Node.js environments without globalThis.crypto
+        const nodeCrypto = globalThis.process?.versions?.node
+            ? globalThis.require('node:crypto')
+            : null;
+        if (nodeCrypto?.randomBytes) {
+            return new Uint8Array(nodeCrypto.randomBytes(length));
+        }
+    }
+    catch {
+        // Fallback ignored
+    }
+    throw new Error('Cryptographically secure random number generator is unavailable.');
+}
+/**
+ * Encodes raw bytes into a base62 string.
+ */
+function bytesToBase62(bytes) {
+    let result = '';
+    for (let i = 0; i < bytes.length; i++) {
+        result += BASE62_ALPHABET[bytes[i] % 62];
+    }
+    return result;
+}
+/**
+ * Calculates a 4-byte (8-char hex) checksum over the prefix and random entropy.
+ */
+function calculateKeyChecksum(content) {
+    const hash = (0, sha2_js_1.sha256)((0, utils_js_1.utf8ToBytes)(content));
+    return (0, utils_js_1.bytesToHex)(hash.slice(0, 4));
+}
+/**
+ * Constant-time string comparison to prevent timing attacks.
+ */
+function timingSafeEqual(a, b) {
+    if (a.length !== b.length) {
+        return false;
+    }
+    let mismatch = 0;
+    for (let i = 0; i < a.length; i++) {
+        mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    }
+    return mismatch === 0;
+}
+/**
+ * Hashes an API key using SHA-256 for secure storage.
+ */
+function hashApiKey(key) {
+    return (0, utils_js_1.bytesToHex)((0, sha2_js_1.sha256)((0, utils_js_1.utf8ToBytes)(key.trim())));
+}
+/**
+ * Generates an industry-standard, cryptographically secure API key.
+ * Format: [prefix]_[entropy]_[checksum]
+ *
+ * Example:
+ * prop_a7F9x2K1m8P0qW4z_c4f910e2
+ */
+function generateApiKey(options = {}) {
+    const prefix = (options.prefix || 'key').trim().toLowerCase().replace(/[^a-z0-9_-]/g, '');
+    const byteLength = options.byteLength ?? 24;
+    const withChecksum = options.withChecksum ?? true;
+    const entropyBytes = getRandomBytes(byteLength);
+    const entropy = bytesToBase62(entropyBytes);
+    let key;
+    let checksum = '';
+    if (withChecksum) {
+        checksum = calculateKeyChecksum(`${prefix}_${entropy}`);
+        key = `${prefix}_${entropy}_${checksum}`;
+    }
+    else {
+        key = `${prefix}_${entropy}`;
+    }
+    const keyHash = hashApiKey(key);
+    // Masked display representation (e.g. prop_...c4f910e2)
+    const suffix = key.slice(-6);
+    const display = `${prefix}_...${suffix}`;
+    return {
+        key,
+        keyHash,
+        prefix,
+        display,
+    };
+}
+/**
+ * Verifies whether a key string is syntactically valid and has an authentic checksum.
+ * Does not require a database lookup.
+ */
+function verifyApiKeyFormat(key, expectedPrefix) {
+    if (!key || typeof key !== 'string')
+        return false;
+    const parts = key.trim().split('_');
+    if (parts.length < 2)
+        return false;
+    const prefix = parts[0];
+    if (expectedPrefix && prefix !== expectedPrefix)
+        return false;
+    // Checksummed format: [prefix]_[entropy]_[checksum]
+    if (parts.length >= 3) {
+        const checksum = parts[parts.length - 1];
+        const content = parts.slice(0, parts.length - 1).join('_');
+        const expectedChecksum = calculateKeyChecksum(content);
+        return timingSafeEqual(checksum, expectedChecksum);
+    }
+    return true;
+}
+/**
+ * Validates a raw API key against a stored SHA-256 hash in constant time.
+ */
+function verifyApiKey(rawKey, storedHash, expectedPrefix) {
+    if (!verifyApiKeyFormat(rawKey, expectedPrefix)) {
+        return false;
+    }
+    const computedHash = hashApiKey(rawKey);
+    return timingSafeEqual(computedHash, storedHash);
+}

package/dist/keys/index.d.ts

@@ -0,0 +1,5 @@
+export * from './types.js';
+export * from './generator.js';
+export * from './signed-token.js';
+export * from './store.js';
+export * from './manager.js';

package/dist/keys/index.js

@@ -0,0 +1,21 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./types.js"), exports);
+__exportStar(require("./generator.js"), exports);
+__exportStar(require("./signed-token.js"), exports);
+__exportStar(require("./store.js"), exports);
+__exportStar(require("./manager.js"), exports);

package/dist/keys/manager.d.ts

@@ -0,0 +1,59 @@
+import { LocalDBAdapter } from '../adapters/local/index.js';
+import { ApiKeyManagerOptions, ApiKeyRecord, CreateSignedTokenOptions, GenerateApiKeyOptions, RenewSignedTokenOptions, VerifySignedTokenResult, VerifyStoredKeyResult } from './types.js';
+export declare class ApiKeyManager {
+    private db;
+    private tableName;
+    constructor(db: LocalDBAdapter, options?: ApiKeyManagerOptions);
+    /**
+     * Initializes the API keys database table and indexes.
+     */
+    initialize(): Promise<void>;
+    /**
+     * Generates a new cryptographically secure API key and persists its hash to SQLite.
+     * Returns the plaintext key (to show to the user once) along with the stored record.
+     */
+    create(options?: GenerateApiKeyOptions): Promise<{
+        key: string;
+        record: ApiKeyRecord;
+    }>;
+    /**
+     * Verifies an incoming raw API key against stored hashes in SQLite.
+     * Checks format, checksum, expiration, and revocation status.
+     */
+    verify(rawKey: string, options?: {
+        updateLastUsed?: boolean;
+        expectedPrefix?: string;
+    }): Promise<VerifyStoredKeyResult>;
+    /**
+     * Revokes an existing API key by ID.
+     */
+    revoke(id: string): Promise<boolean>;
+    /**
+     * Lists stored API key records with optional filters.
+     */
+    list(filter?: {
+        revoked?: boolean;
+        prefix?: string;
+    }): Promise<ApiKeyRecord[]>;
+    /**
+     * Prunes revoked or expired key records.
+     */
+    prune(options?: {
+        revokedOlderThanMs?: number;
+        expiredOlderThanMs?: number;
+    }): Promise<number>;
+    /**
+     * Helper to create a signed, tamper-evident token with expiration.
+     */
+    createSignedToken<T = Record<string, any>>(options: CreateSignedTokenOptions<T>): string;
+    /**
+     * Helper to verify a signed token's signature and expiration.
+     */
+    verifySignedToken<T = Record<string, any>>(token: string, secret: string, options?: {
+        clockSkewSeconds?: number;
+    }): VerifySignedTokenResult<T>;
+    /**
+     * Helper to renew an existing signed token by extending its expiration.
+     */
+    renewSignedToken<T = Record<string, any>>(token: string, secret: string, options?: RenewSignedTokenOptions): string;
+}

package/dist/keys/manager.js

@@ -0,0 +1,127 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiKeyManager = void 0;
+const uuid_js_1 = require("../utils/uuid.js");
+const generator_js_1 = require("./generator.js");
+const signed_token_js_1 = require("./signed-token.js");
+const store_js_1 = require("./store.js");
+class ApiKeyManager {
+    db;
+    tableName;
+    constructor(db, options = {}) {
+        this.db = db;
+        this.tableName = options.tableName || store_js_1.DEFAULT_KEYS_TABLE;
+    }
+    /**
+     * Initializes the API keys database table and indexes.
+     */
+    async initialize() {
+        await store_js_1.KeyStore.ensureSchema(this.db, this.tableName);
+    }
+    /**
+     * Generates a new cryptographically secure API key and persists its hash to SQLite.
+     * Returns the plaintext key (to show to the user once) along with the stored record.
+     */
+    async create(options = {}) {
+        const generated = (0, generator_js_1.generateApiKey)(options);
+        const now = Date.now();
+        const expiresAt = options.expiresAt !== undefined
+            ? options.expiresAt
+            : options.expiresInMs !== undefined
+                ? now + options.expiresInMs
+                : null;
+        const record = {
+            id: (0, uuid_js_1.generateUUID)(),
+            name: options.name || `${generated.prefix} key`,
+            prefix: generated.prefix,
+            display: generated.display,
+            keyHash: generated.keyHash,
+            metadata: options.metadata,
+            createdAt: now,
+            expiresAt,
+            lastUsedAt: null,
+            revoked: false,
+            revokedAt: null,
+        };
+        await store_js_1.KeyStore.insertRecord(this.db, this.tableName, record);
+        return {
+            key: generated.key,
+            record,
+        };
+    }
+    /**
+     * Verifies an incoming raw API key against stored hashes in SQLite.
+     * Checks format, checksum, expiration, and revocation status.
+     */
+    async verify(rawKey, options = {}) {
+        if (!rawKey || typeof rawKey !== 'string') {
+            return { valid: false, status: 'MALFORMED', error: 'API key is missing or not a string' };
+        }
+        // 1. Instant syntactic & checksum format verification
+        if (!(0, generator_js_1.verifyApiKeyFormat)(rawKey, options.expectedPrefix)) {
+            return { valid: false, status: 'MALFORMED', error: 'Invalid API key format or checksum' };
+        }
+        // 2. Hash and lookup in database
+        const computedHash = (0, generator_js_1.hashApiKey)(rawKey);
+        const record = await store_js_1.KeyStore.findByHash(this.db, this.tableName, computedHash);
+        if (!record) {
+            return { valid: false, status: 'INVALID', error: 'API key not found' };
+        }
+        // 3. Check revocation
+        if (record.revoked) {
+            return { valid: false, status: 'REVOKED', record, error: 'API key has been revoked' };
+        }
+        // 4. Check expiration
+        if (record.expiresAt && record.expiresAt <= Date.now()) {
+            return { valid: false, status: 'EXPIRED', record, error: 'API key has expired' };
+        }
+        // 5. Update last_used_at timestamp
+        if (options.updateLastUsed !== false) {
+            const now = Date.now();
+            record.lastUsedAt = now;
+            store_js_1.KeyStore.updateLastUsed(this.db, this.tableName, record.id, now).catch(() => { });
+        }
+        return {
+            valid: true,
+            status: 'VALID',
+            record,
+        };
+    }
+    /**
+     * Revokes an existing API key by ID.
+     */
+    async revoke(id) {
+        return store_js_1.KeyStore.revoke(this.db, this.tableName, id);
+    }
+    /**
+     * Lists stored API key records with optional filters.
+     */
+    async list(filter) {
+        return store_js_1.KeyStore.list(this.db, this.tableName, filter);
+    }
+    /**
+     * Prunes revoked or expired key records.
+     */
+    async prune(options) {
+        return store_js_1.KeyStore.prune(this.db, this.tableName, options);
+    }
+    /**
+     * Helper to create a signed, tamper-evident token with expiration.
+     */
+    createSignedToken(options) {
+        return (0, signed_token_js_1.createSignedToken)(options);
+    }
+    /**
+     * Helper to verify a signed token's signature and expiration.
+     */
+    verifySignedToken(token, secret, options) {
+        return (0, signed_token_js_1.verifySignedToken)(token, secret, options);
+    }
+    /**
+     * Helper to renew an existing signed token by extending its expiration.
+     */
+    renewSignedToken(token, secret, options) {
+        return (0, signed_token_js_1.renewSignedToken)(token, secret, options);
+    }
+}
+exports.ApiKeyManager = ApiKeyManager;

package/dist/keys/signed-token.d.ts

@@ -0,0 +1,18 @@
+import { CreateSignedTokenOptions, RenewSignedTokenOptions, VerifySignedTokenResult } from './types.js';
+export declare function base64UrlEncode(bytes: Uint8Array): string;
+export declare function base64UrlDecode(str: string): Uint8Array;
+/**
+ * Creates a signed, tamper-evident token with optional expiration and token ID.
+ * Format: [base64urlHeader].[base64urlPayload].[signature]
+ */
+export declare function createSignedToken<T = Record<string, any>>(options: CreateSignedTokenOptions<T>): string;
+/**
+ * Verifies a signed token's cryptographic HMAC signature and expiration timestamp.
+ */
+export declare function verifySignedToken<T = Record<string, any>>(token: string, secret: string, options?: {
+    clockSkewSeconds?: number;
+}): VerifySignedTokenResult<T>;
+/**
+ * Renews an existing valid signed token by extending its expiration time with a fresh signature.
+ */
+export declare function renewSignedToken<T = Record<string, any>>(token: string, secret: string, options?: RenewSignedTokenOptions): string;