import { OpenId4VciCredentialConfigurationsSupportedWithFormats, OpenId4VciCredentialOfferPayload } from "../shared/models/index.mjs";
import { OpenId4VcIssuanceSessionState } from "./OpenId4VcIssuanceSessionState.mjs";
import { OpenId4VcIssuanceSessionRecord } from "./repository/OpenId4VcIssuanceSessionRecord.mjs";
import { OpenId4VcIssuanceSessionRepository } from "./repository/OpenId4VcIssuanceSessionRepository.mjs";
import { OpenId4VcIssuerRecord } from "./repository/OpenId4VcIssuerRecord.mjs";
import { OpenId4VcIssuerRepository } from "./repository/OpenId4VcIssuerRepository.mjs";
import "./repository/index.mjs";
import "../shared/index.mjs";
import { OpenId4VciCreateCredentialOfferOptions, OpenId4VciCreateCredentialResponseOptions, OpenId4VciCreateDeferredCredentialResponseOptions, OpenId4VciCreateIssuerOptions, OpenId4VciCreateStatelessCredentialOfferOptions } from "./OpenId4VcIssuerServiceOptions.mjs";
import { OpenId4VcIssuerModuleConfig } from "./OpenId4VcIssuerModuleConfig.mjs";
import "../index.mjs";
import { AgentContext, Jwt, Query, QueryOptions, W3cCredentialService, W3cV2CredentialService } from "@credo-ts/core";
import { Jwk, Oauth2AuthorizationServer, Oauth2Client, Oauth2ResourceServer, PkceCodeChallengeMethod } from "@openid4vc/oauth2";
import { CredentialResponse, DeferredCredentialResponse, Openid4vciIssuer, Openid4vciVersion } from "@openid4vc/openid4vci";

//#region src/openid4vc-issuer/OpenId4VcIssuerService.d.ts
/**
 * @internal
 */
declare class OpenId4VcIssuerService {
  private w3cCredentialService;
  private w3cV2CredentialService;
  private openId4VcIssuerConfig;
  private openId4VcIssuerRepository;
  private openId4VcIssuanceSessionRepository;
  constructor(w3cCredentialService: W3cCredentialService, w3cV2CredentialService: W3cV2CredentialService, openId4VcIssuerConfig: OpenId4VcIssuerModuleConfig, openId4VcIssuerRepository: OpenId4VcIssuerRepository, openId4VcIssuanceSessionRepository: OpenId4VcIssuanceSessionRepository);
  createStatelessCredentialOffer(agentContext: AgentContext, options: OpenId4VciCreateStatelessCredentialOfferOptions & {
    issuer: OpenId4VcIssuerRecord;
  }): Promise<{
    credentialOffer: string;
    credentialOfferObject: OpenId4VciCredentialOfferPayload;
  }>;
  createCredentialOffer(agentContext: AgentContext, options: OpenId4VciCreateCredentialOfferOptions & {
    issuer: OpenId4VcIssuerRecord;
  }): Promise<{
    issuanceSession: OpenId4VcIssuanceSessionRecord;
    credentialOffer: string;
  }>;
  createCredentialResponse(agentContext: AgentContext, options: OpenId4VciCreateCredentialResponseOptions & {
    issuanceSession: OpenId4VcIssuanceSessionRecord;
  }): Promise<{
    issuanceSession: OpenId4VcIssuanceSessionRecord;
    credentialResponse: CredentialResponse;
  }>;
  createDeferredCredentialResponse(agentContext: AgentContext, options: OpenId4VciCreateDeferredCredentialResponseOptions & {
    issuanceSession: OpenId4VcIssuanceSessionRecord;
  }): Promise<{
    issuanceSession: OpenId4VcIssuanceSessionRecord;
    deferredCredentialResponse: DeferredCredentialResponse;
  }>;
  private verifyCredentialRequestProofs;
  findIssuanceSessionsByQuery(agentContext: AgentContext, query: Query<OpenId4VcIssuanceSessionRecord>, queryOptions?: QueryOptions): Promise<OpenId4VcIssuanceSessionRecord[]>;
  findSingleIssuanceSessionByQuery(agentContext: AgentContext, query: Query<OpenId4VcIssuanceSessionRecord>): Promise<OpenId4VcIssuanceSessionRecord | null>;
  getIssuanceSessionById(agentContext: AgentContext, issuanceSessionId: string): Promise<OpenId4VcIssuanceSessionRecord>;
  getAllIssuers(agentContext: AgentContext): Promise<OpenId4VcIssuerRecord[]>;
  getIssuerByIssuerId(agentContext: AgentContext, issuerId: string): Promise<OpenId4VcIssuerRecord>;
  updateIssuer(agentContext: AgentContext, issuer: OpenId4VcIssuerRecord): Promise<void>;
  createIssuer(agentContext: AgentContext, options: OpenId4VciCreateIssuerOptions): Promise<OpenId4VcIssuerRecord>;
  private createSignedMetadata;
  rotateAccessTokenSigningKey(agentContext: AgentContext, issuer: OpenId4VcIssuerRecord, options?: Pick<OpenId4VciCreateIssuerOptions, 'accessTokenSignerKeyType'>): Promise<void>;
  /**
   * @param fetchExternalAuthorizationServerMetadata defaults to false
   */
  getIssuerMetadata(agentContext: AgentContext, issuerRecord: OpenId4VcIssuerRecord, fetchExternalAuthorizationServerMetadata?: boolean): Promise<{
    originalDraftVersion: Openid4vciVersion;
    credentialIssuer: {
      credential_issuer: string;
      credential_endpoint: string;
      deferred_credential_endpoint: string;
      credential_configurations_supported: OpenId4VciCredentialConfigurationsSupportedWithFormats;
      authorization_servers: string[] | undefined;
      display: {
        [x: string]: unknown;
        name?: string | undefined;
        locale?: string | undefined;
        logo?: {
          [x: string]: unknown;
          uri?: string | undefined;
          alt_text?: string | undefined;
        } | undefined;
      }[] | undefined;
      nonce_endpoint: string;
      batch_credential_issuance: {
        batch_size: number;
      } | undefined;
    };
    authorizationServers: ({
      [x: string]: unknown;
      issuer: string;
      token_endpoint: string;
      token_endpoint_auth_methods_supported?: string[] | undefined;
      authorization_endpoint?: string | undefined;
      jwks_uri?: string | undefined;
      grant_types_supported?: string[] | undefined;
      code_challenge_methods_supported?: string[] | undefined;
      dpop_signing_alg_values_supported?: string[] | undefined;
      require_pushed_authorization_requests?: boolean | undefined;
      pushed_authorization_request_endpoint?: string | undefined;
      introspection_endpoint?: string | undefined;
      introspection_endpoint_auth_methods_supported?: string[] | undefined;
      introspection_endpoint_auth_signing_alg_values_supported?: string[] | undefined;
      authorization_challenge_endpoint?: string | undefined;
      'pre-authorized_grant_anonymous_access_supported'?: boolean | undefined;
      client_attestation_pop_nonce_required?: boolean | undefined;
      authorization_response_iss_parameter_supported?: boolean | undefined;
    } | {
      issuer: string;
      token_endpoint: string;
      'pre-authorized_grant_anonymous_access_supported': true;
      jwks_uri: string;
      grant_types_supported: ("authorization_code" | "urn:ietf:params:oauth:grant-type:pre-authorized_code")[];
      authorization_challenge_endpoint: string;
      authorization_endpoint: string;
      pushed_authorization_request_endpoint: string;
      require_pushed_authorization_requests: true;
      code_challenge_methods_supported: PkceCodeChallengeMethod[];
      dpop_signing_alg_values_supported: ["HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "PS256" | "PS384" | "PS512" | "EdDSA" | "Ed25519" | "ES256K", ...("HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "PS256" | "PS384" | "PS512" | "EdDSA" | "Ed25519" | "ES256K")[]] | undefined;
      authorization_response_iss_parameter_supported: true;
    })[];
    knownCredentialConfigurations: OpenId4VciCredentialConfigurationsSupportedWithFormats;
    signedMetadataJwt: string | undefined;
  }>;
  createNonce(agentContext: AgentContext, issuer: OpenId4VcIssuerRecord): Promise<{
    cNonce: string;
    cNonceExpiresAt: Date;
    cNonceExpiresInSeconds: number;
  }>;
  /**
   * @todo nonces are very short lived (1 min), but it might be nice to also cache the nonces
   * in the cache if we have 'seen' them. They will only be in the cache for a short time
   * and it will prevent replay
   */
  private verifyNonce;
  createRefreshToken(agentContext: AgentContext, issuer: OpenId4VcIssuerRecord, options: {
    issuerState?: string;
    preAuthorizedCode?: string;
    dpop?: {
      jwk: Jwk;
    };
  }): Promise<string>;
  parseRefreshToken(agentContext: AgentContext, token: string): {
    jwt: Jwt;
    expiresAt: Date;
    issuerState: string | undefined;
    preAuthorizedCode: string | undefined;
    dpop: {
      jwkThumbprint: string;
    } | undefined;
  };
  verifyRefreshToken(agentContext: AgentContext, issuer: OpenId4VcIssuerRecord, parsedRefreshToken: ReturnType<OpenId4VcIssuerService['parseRefreshToken']>, options?: {
    dpop?: {
      jwkThumbprint?: string;
    };
  }): Promise<void>;
  getIssuer(agentContext: AgentContext, options?: {
    issuanceSessionId?: string;
  }): Openid4vciIssuer;
  getOauth2Client(agentContext: AgentContext, issuerRecord?: OpenId4VcIssuerRecord): Oauth2Client;
  getOauth2AuthorizationServer(agentContext: AgentContext, options?: {
    issuanceSessionId?: string;
  }): Oauth2AuthorizationServer;
  getResourceServer(agentContext: AgentContext, issuerRecord: OpenId4VcIssuerRecord): Oauth2ResourceServer;
  /**
   * Update the expiresAt field of the issuance session to ensure it remains
   * valid during the deferral process.
   *
   * We set it to the maximum between the current expiresAt and the current time
   * plus interval and the grace period. This accounts for the chance of multiple
   * deferrals happening, always retaining the longer interval.
   */
  private updateExpiresAt;
  /**
   * Update the record to a new state and emit an state changed event. Also updates the record
   * in storage.
   */
  updateState(agentContext: AgentContext, issuanceSession: OpenId4VcIssuanceSessionRecord, newState: OpenId4VcIssuanceSessionState): Promise<void>;
  emitStateChangedEvent(agentContext: AgentContext, issuanceSession: OpenId4VcIssuanceSessionRecord, previousState: OpenId4VcIssuanceSessionState | null): void;
  private getGrantsFromConfig;
  private getCredentialConfigurationsForRequest;
  private getSignedCredentials;
  private signW3cCredential;
}
//#endregion
export { OpenId4VcIssuerService };
//# sourceMappingURL=OpenId4VcIssuerService.d.mts.map