/**
 * Resolve the DPoP binding for a token-endpoint request.
 *
 * @param {import('../request.js').ServerRequest} req
 * @param {Record<string, any>} config
 * @param {import('../clients.js').Client} client
 * @param {{ htu?: string }} [options]  the endpoint URL the proof must bind to (default the token endpoint)
 * @returns {Promise<{ dpopJkt: string | undefined, nonceHeaders: Record<string, string> }>}
 */
export function resolveDpopBinding(req: import("../request.js").ServerRequest, config: Record<string, any>, client: import("../clients.js").Client, options?: {
    htu?: string;
}): Promise<{
    dpopJkt: string | undefined;
    nonceHeaders: Record<string, string>;
}>;
/**
 * Verify a DPoP proof JWT and return its key thumbprint (`jkt`) plus the
 * `nonce` claim (if any) for the caller's nonce-challenge check.
 *
 * @param {string} proof
 * @param {{ htm: string, htu: string, ath?: string }} binding
 * @returns {Promise<{ jkt: string, nonce: string | undefined }>}
 */
export function verifyDpopProof(proof: string, binding: {
    htm: string;
    htu: string;
    ath?: string;
}): Promise<{
    jkt: string;
    nonce: string | undefined;
}>;
/**
 * Resource-server DPoP check (RFC 9449 §7). A protected resource calls
 * this with the `DPoP` proof header, the presented access token, and the
 * token's `cnf.jkt` (from the JWT claim or introspection). It verifies the
 * proof, that its `ath` binds to this exact token, and that the proving
 * key is the one the token was issued to — the missing high-level helper
 * for the resource-server half of DPoP.
 *
 * @param {string} proof                          the `DPoP` request header
 * @param {{ htm: string, htu: string, accessToken: string, cnfJkt: string }} binding
 * @returns {Promise<{ jkt: string }>}
 */
export function verifyDpopForResource(proof: string, binding: {
    htm: string;
    htu: string;
    accessToken: string;
    cnfJkt: string;
}): Promise<{
    jkt: string;
}>;
/** Test hook — clear the replay + nonce caches between cases. */
export function _clearDpopReplayCache(): void;
/** Test hook — mint a nonce as the server would (to seed a proof). */
export function _issueDpopNonce(): string;