import type { CID } from 'multiformats';
import type { DidResolver } from '../did/did-resolver.js';
import type { GeneralJws } from '../types/jws-types.js';
import type { GenericMessage } from '../types/message-types.js';
import type { Message } from './message.js';
import type { VerificationResult } from '../jose/jws/general/verifier.js';
export declare class Authenticate {
    /**
     * Validates the signature(s) of the given JWS.
     * @throws {Error} if fails authentication
     */
    static authenticate(jws: GeneralJws | undefined, didResolver: DidResolver): Promise<VerificationResult>;
}
/**
 * Authenticates then authorizes the given message using the "canonical" auth flow.
 * Some message auth require special handling such as `RecordsWrite` and `RecordsQuery`,
 * which would be incompatible with this auth flow.
 * @throws {Error} if auth fails
 */
export declare function canonicalAuth(tenant: string, incomingMessage: Message<GenericMessage>, didResolver: DidResolver): Promise<void>;
/**
 * Validates the structural integrity of the `authorization` property.
 * NOTE: signature is not verified.
 * @returns the parsed JSON payload object if validation succeeds.
 */
export declare function validateAuthorizationIntegrity(message: GenericMessage, jsonSchemaKey?: string): Promise<{
    descriptorCid: CID;
    [key: string]: any;
}>;
/**
 * Validates the signature(s) of the given JWS.
 * @throws {Error} if fails authentication
 */
export declare function authenticate(jws: GeneralJws | undefined, didResolver: DidResolver): Promise<void>;
/**
 * Authorizes the incoming message.
 * @throws {Error} if fails authentication
 */
export declare function authorize(tenant: string, incomingMessage: Message<GenericMessage>): Promise<void>;
//# sourceMappingURL=auth.d.ts.map