import { LoadClientKeysOptions, ClientWithKeys } from "./client-keys";
declare const ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
export type ClientAssertionMethod = "private_key_jwt" | "client_secret_jwt";
export declare class ClientAssertionError extends Error {
    code: "invalid_client" | "invalid_request" | "unsupported_alg" | "missing_keys";
    constructor(code: "invalid_client" | "invalid_request" | "unsupported_alg" | "missing_keys", message: string);
}
export interface ClientAssertionClient extends ClientWithKeys {
    client_id: string;
    client_secret?: string | undefined;
}
export interface VerifyClientAssertionOptions extends LoadClientKeysOptions {
    /**
     * Acceptable values for the `aud` claim. Per RFC 7523 §3 the assertion's
     * audience MUST identify the authorization server, typically as the token
     * endpoint URL or the issuer. We accept either.
     */
    acceptedAudiences: string[];
    /** Clock-skew leeway in seconds. Defaults to 30. */
    leewaySeconds?: number;
    /** Override Date.now() for tests. */
    now?: () => number;
}
export interface VerifiedClientAssertion {
    /** The authenticated client_id (extracted from the assertion's `sub`). */
    clientId: string;
    /** Which authentication method was actually used. */
    method: ClientAssertionMethod;
    /** Optional jti claim — useful if callers want to enforce replay protection. */
    jti?: string;
    /** The full verified payload, in case callers need other claims. */
    payload: Record<string, unknown>;
}
/**
 * Verify an RFC 7523 client assertion JWT. Used by the `/oauth/token` endpoint
 * to authenticate clients that registered with `token_endpoint_auth_method`
 * = `private_key_jwt` or `client_secret_jwt`.
 *
 * The caller has already resolved the client (typically via the assertion's
 * `iss`/`sub` claim or an explicit `client_id` form param). This function
 * verifies that the assertion is signed by a key the client owns and that the
 * standard claims are correct.
 *
 * @throws ClientAssertionError when the assertion is malformed, signed with
 *   an unsupported alg, signed with a key the client doesn't own, or fails
 *   any of the iss/sub/aud/exp checks.
 */
export declare function verifyClientAssertion(assertion: string, client: ClientAssertionClient, opts: VerifyClientAssertionOptions): Promise<VerifiedClientAssertion>;
export { ASSERTION_TYPE as CLIENT_ASSERTION_TYPE };
