import { LoadClientKeysOptions, ClientWithKeys } from "./client-keys";
/**
 * Narrow client shape used by the request-object verifier. Allows passing
 * `EnrichedClient` (which redefines `connections`) without a structural
 * mismatch against the wider `Client` type.
 */
export interface RequestObjectClient extends ClientWithKeys {
    client_id: string;
    client_secret?: string | undefined;
}
export declare class RequestObjectVerificationError extends Error {
    code: "invalid_request_object" | "unsupported_alg" | "missing_keys" | "signature_invalid" | "claim_invalid";
    constructor(code: "invalid_request_object" | "unsupported_alg" | "missing_keys" | "signature_invalid" | "claim_invalid", message: string);
}
export interface VerifyRequestObjectOptions extends LoadClientKeysOptions {
    /**
     * Issuer URL of this authorization server. The `aud` claim of the request
     * object MUST match this (as a string or one element of an array). When
     * unset, the audience check is skipped — only enable for testing.
     */
    issuer: string;
    /** Optional clock-skew leeway in seconds for exp/nbf checks. Defaults to 30. */
    leewaySeconds?: number;
    /** Override Date.now() for tests (returns ms since epoch). */
    now?: () => number;
}
/**
 * Verify an OIDC Request Object (signed JWT, RFC 9101 / OIDC Core 6.1) sent
 * via the `request=` parameter or fetched from `request_uri=`.
 *
 * Returns the parsed JWT claims when the signature is valid, the alg is
 * supported, and basic temporal/audience checks pass. Throws
 * RequestObjectVerificationError otherwise.
 *
 * `alg: none` (unsigned) request objects are rejected. The current `request=`
 * pre-check in /authorize used to accept these unconditionally, which let any
 * caller forge claims; closing that hole is the main motivator for this code
 * path.
 */
export declare function verifyRequestObject(jwt: string, client: RequestObjectClient, opts: VerifyRequestObjectOptions): Promise<Record<string, unknown>>;
