export type CapturedAAuthAccessMode = 'agent-token' | 'aauth-access-token' | 'auth-token';
export type CapturedAAuthTokenKind = 'agent_token' | 'resource_token' | 'auth_token';
export interface CapturedAAuthTokenClaims {
    iss?: string;
    sub?: string;
    aud?: string | string[];
    exp?: number;
    iat?: number;
    nbf?: number;
    jti?: string;
    dwk?: string;
    agent?: string;
    agent_jkt?: string;
    scope?: string | string[];
    resource?: string | string[];
    cnf?: {
        jwk?: unknown;
        jkt?: string;
        [key: string]: unknown;
    };
    act?: {
        sub?: string;
        act?: unknown;
        [key: string]: unknown;
    };
    mission?: {
        approver?: string;
        s256?: string;
        [key: string]: unknown;
    };
    tenant?: string;
    ps?: string;
    parent_agent?: string;
    r3_uri?: string;
    r3_s256?: string;
    r3_granted?: string[];
    r3_conditional?: unknown;
}
export interface CapturedAAuthMissionClaim {
    approver?: string;
    s256?: string;
    [key: string]: unknown;
}
export interface CapturedAAuthResourceMetadataEvidence {
    issuer?: string;
    resource?: string;
    access_mode?: CapturedAAuthAccessMode;
}
export interface CapturedAAuthHttpSignatureEvidence {
    verified?: boolean;
    scheme?: string;
    coveredComponents?: string[];
    signingKeyJkt?: string;
}
export interface CapturedAAuthR3Evidence {
    uri?: string;
    s256?: string;
    expectedS256?: string;
    documentHashVerified?: boolean;
    granted?: string[];
    conditional?: unknown;
}
export interface CapturedAAuthEvidence {
    protocol: 'aauth';
    tokenKind?: CapturedAAuthTokenKind;
    accessMode?: CapturedAAuthAccessMode;
    claimsVerified: boolean;
    claims: CapturedAAuthTokenClaims;
    token_hash?: string;
    issuer?: string;
    audience?: string | string[];
    resource?: string;
    resourceMetadata?: CapturedAAuthResourceMetadataEvidence;
    requiredScopes?: string[];
    expectedAgent?: string;
    expectedSubject?: string;
    expectedActSubject?: string;
    requireAct?: boolean;
    expectedCnfJkt?: string;
    expectedAgentJkt?: string;
    expectedParentAgent?: string;
    requiredMission?: CapturedAAuthMissionClaim;
    httpSignature?: CapturedAAuthHttpSignatureEvidence;
    r3?: CapturedAAuthR3Evidence;
}
export interface AAuthEvidenceCaptureOptions {
    tokenKind?: CapturedAAuthTokenKind;
    accessMode?: CapturedAAuthAccessMode;
    claimsVerified?: boolean;
    includeTokenHash?: boolean;
    issuer?: string;
    audience?: string | string[];
    resource?: string;
    resourceMetadata?: CapturedAAuthResourceMetadataEvidence;
    requiredScopes?: string[];
    expectedAgent?: string;
    expectedSubject?: string;
    expectedActSubject?: string;
    requireAct?: boolean;
    expectedCnfJkt?: string;
    expectedAgentJkt?: string;
    expectedParentAgent?: string;
    requiredMission?: CapturedAAuthMissionClaim;
    httpSignatureVerified?: boolean;
    signingKeyJkt?: string;
    r3?: CapturedAAuthR3Evidence;
}
export declare function buildAAuthEvidenceFromEvent(event: unknown, options?: AAuthEvidenceCaptureOptions): CapturedAAuthEvidence | undefined;
//# sourceMappingURL=aauth-evidence.d.ts.map