/**
 * Verify a JAR request object and return the authorization parameters it
 * carries. `outerClientId` is the `client_id` sent as a plain parameter
 * (RFC 9101 requires it alongside `request`).
 *
 * @param {string} requestJwt
 * @param {string | undefined} outerClientId
 * @param {Record<string, any>} config
 * @returns {Promise<Record<string, unknown>>}
 */
export function verifyRequestObject(requestJwt: string, outerClientId: string | undefined, config: Record<string, any>): Promise<Record<string, unknown>>;
/**
 * Sign an authorization response as a JARM JWT (`response` parameter).
 * The AS returns this instead of bare `code` / `state` query params when
 * the client requests `response_mode=jwt`.
 *
 * @param {Record<string, unknown>} responseParams   e.g. `{ code, state, iss }`
 * @param {string} audience                           the client_id
 * @param {Record<string, any>} config
 * @returns {Promise<string>}
 */
export function signJarmResponse(responseParams: Record<string, unknown>, audience: string, config: Record<string, any>): Promise<string>;