import type { PublicJwks, TokenType } from "../../contracts/auth.js";
import type { JwtVerifier } from "../../contracts/route.js";
import { type KeyResolver } from "./tokens.js";
export interface CreateJwksVerifierOptions {
    jwksUri: string;
    expectedIssuer: string;
    expectedAudience: string;
    expectedTokenType?: TokenType;
    clockToleranceSeconds?: number;
}
/**
 * Build a JwtVerifier that fetches signing keys from a remote JWKS endpoint.
 * Use when verifying tokens issued by a separate auth service.
 */
export declare function createJwksVerifier(options: CreateJwksVerifierOptions): JwtVerifier;
export interface CreateLocalVerifierOptions {
    keyResolver: KeyResolver;
    expectedIssuer: string;
    expectedAudience: string;
    expectedTokenType?: TokenType;
    clockToleranceSeconds?: number;
}
export interface CreateStaticJwksVerifierOptions {
    /** JWKS document - keys pushed by the auth service at /install. */
    jwks: PublicJwks;
    expectedIssuer: string;
    expectedAudience: string;
    expectedTokenType?: TokenType;
    clockToleranceSeconds?: number;
}
/**
 * Build a JwtVerifier that resolves signing keys from an in-memory JWKS doc.
 * Use when the CP cannot reach the issuer for live JWKS fetches - keys are
 * pushed by the auth service at /install (and on rotation) and cached in
 * app.auth.publicKeys.
 */
export declare function createStaticJwksVerifier(options: CreateStaticJwksVerifierOptions): JwtVerifier;
/**
 * Build a JwtVerifier that uses an in-process key resolver.
 * Use when the verifying service is the same as the issuer (auth provider verifying its own refresh tokens).
 */
export declare function createLocalVerifier(options: CreateLocalVerifierOptions): JwtVerifier;
//# sourceMappingURL=verifier.d.ts.map