import type { DidDocument } from "./pom-verifier.js";
export interface ParsedJws {
    header: Record<string, unknown>;
    payload: Record<string, unknown>;
    signingInput: string;
    signature: Uint8Array;
}
/** How the issuer's DID document is found. */
export interface DidOptions {
    /**
     * Issuer DIDs to accept, exactly. Also passed to the resolver, so a DID
     * outside the list is never fetched.
     */
    allowedIssuers?: string[];
    /** Resolves the issuer's DID document; defaults to `did:web` over HTTPS. */
    didResolver?: (did: string) => Promise<DidDocument | null>;
}
export declare const isRecord: (value: unknown) => value is Record<string, unknown>;
/** A compact JWS of three base64url segments whose header and payload are JSON objects; else null. */
export declare function parseJws(token: string): ParsedJws | null;
/**
 * Checks that the key `kid` names signed `parsed`, PS256: the key must be an
 * RSA assertion method of the document `iss` resolves to, and that document
 * must be `iss`'s own. Each problem is pushed to `errors`; `noun` names the
 * token in the signature's message ("the receipt key did not sign this receipt").
 */
export declare function checkPs256Signature(parsed: ParsedJws, iss: string, kid: string, options: DidOptions, errors: string[], noun: string): Promise<void>;
//# sourceMappingURL=signed-token.d.ts.map