/**
 * Build a cached JWKS resolver for a provider's `jwks_uri`. Thin wrapper
 * over `createRemoteJWKS` so the engine holds one resolver per provider
 * (TTL cache + kid-miss refetch survive key rotation).
 *
 * @param {string} jwksUri
 * @param {import('@exortek/jwks').RemoteJWKSOptions} [options]
 * @returns {(header: { kid: string, alg?: string }) => Promise<import('node:crypto').KeyObject>}
 */
export function createJwksResolver(jwksUri: string, options?: import("@exortek/jwks").RemoteJWKSOptions): (header: {
    kid: string;
    alg?: string;
}) => Promise<any>;
/**
 * @typedef {Object} VerifyIdTokenOptions
 * @property {(header: { kid: string, alg?: string }) => Promise<import('node:crypto').KeyObject>} jwks  key resolver (from {@link createJwksResolver})
 * @property {string} issuer          expected `iss` (exact match)
 * @property {string} clientId        expected `aud`
 * @property {string} [nonce]         expected `nonce` (OIDC replay guard)
 * @property {string|number} [clockTolerance]  leeway for exp/nbf/iat
 * @property {string[]} [algs]        signature alg allowlist
 * @property {string} [accessToken]   present → `at_hash` is enforced
 * @property {string} [code]          present → `c_hash` is enforced
 */
/**
 * Verify a provider `id_token` and return its claims.
 *
 * @param {string} idToken
 * @param {VerifyIdTokenOptions} options
 * @returns {Promise<{ claims: Record<string, unknown>, header: Record<string, unknown>, sub: string }>}
 */
export function verifyIdToken(idToken: string, options: VerifyIdTokenOptions): Promise<{
    claims: Record<string, unknown>;
    header: Record<string, unknown>;
    sub: string;
}>;
/**
 * OIDC hash-binding value (`at_hash` / `c_hash`): base64url of the
 * left-most half of the hash of the ASCII value, where the hash matches
 * the id_token's signing alg (…256 → SHA-256, …384 → SHA-384, …512 →
 * SHA-512). EdDSA uses SHA-512 (OIDC Core §3.1.3.6, Ed25519). Exported so
 * the authorization server's id_token signer computes `at_hash` with the
 * exact same rule the RP side verifies it by.
 *
 * @param {string} value
 * @param {string} alg
 * @returns {string}
 */
export function tokenHash(value: string, alg: string): string;
export const DEFAULT_ID_TOKEN_ALGS: string[];
export type VerifyIdTokenOptions = {
    /**
     * key resolver (from {@link createJwksResolver})
     */
    jwks: (header: {
        kid: string;
        alg?: string;
    }) => Promise<any>;
    /**
     * expected `iss` (exact match)
     */
    issuer: string;
    /**
     * expected `aud`
     */
    clientId: string;
    /**
     * expected `nonce` (OIDC replay guard)
     */
    nonce?: string | undefined;
    /**
     * leeway for exp/nbf/iat
     */
    clockTolerance?: string | number | undefined;
    /**
     * signature alg allowlist
     */
    algs?: string[] | undefined;
    /**
     * present → `at_hash` is enforced
     */
    accessToken?: string | undefined;
    /**
     * present → `c_hash` is enforced
     */
    code?: string | undefined;
};