import * as _openid4vc_oauth2 from '@openid4vc/oauth2';
import { CallbackContext, JwtSigner as JwtSigner$1, JwtSignerJwk as JwtSignerJwk$1, ClientAttestationJwtPayload, RequestDpopOptions, JwtSignerWithJwk as JwtSignerWithJwk$1, HttpMethod as HttpMethod$1 } from '@openid4vc/oauth2';
export { CallbackContext, ClientAttestationPopJwtHeader, ClientAttestationPopJwtPayload, DecryptJweCallback, EncryptJweCallback, GenerateRandomCallback, HashAlgorithm, JweEncryptor, JwtSigner, JwtSignerJwk, Oauth2JwtParseError, RequestDpopOptions, SignJwtCallback, VerifyJwtCallback, verifyJwt } from '@openid4vc/oauth2';
import z, { z as z$1 } from 'zod';
import { RequestLike as RequestLike$1, ItWalletSpecsVersion, IoWalletSdkConfig, FetchHeaders, HttpMethod, BaseSchema, ContentType, Fetch } from '@pagopa/io-wallet-utils';
import { ItWalletAuthorizationServerMetadata } from '@pagopa/io-wallet-oid-federation';

interface RetrieveAuthorizationCodeAccessTokenOptions {
    /**
     * Additional payload to include in the access token request. Items will be encoded and sent
     * using x-www-form-urlencoded format. Nested items (JSON) will be stringified and url encoded.
     */
    additionalRequestPayload?: Record<string, unknown>;
    /**
     * The authorization code
     */
    authorizationCode: string;
    /**
     * Callbacks to use for requesting access token
     */
    callbacks: Pick<CallbackContext, "clientAuthentication" | "fetch" | "generateRandom" | "hash" | "signJwt">;
    /**
     * PKCE Code verifier that was used in the authorization request.
     */
    pkceCodeVerifier: string;
    /**
     * Redirect uri to include in the access token request.
     * It MUST be set as in the Request Object.
     */
    redirectUri: string;
}
/**
 * Creates an OAuth 2.0 authorization-code access token request body.
 *
 * @param options - Access token request inputs.
 * @param options.additionalRequestPayload - Extra form fields to include in the token request.
 * @param options.authorizationCode - Authorization code received from the authorization response.
 * @param options.pkceCodeVerifier - PKCE verifier associated with the authorization request.
 * @param options.redirectUri - Redirect URI used in the authorization request.
 * @returns URL-form-encodable authorization-code grant request data.
 */
declare const createTokenRequest: (options: RetrieveAuthorizationCodeAccessTokenOptions) => Promise<{
    code: string;
    code_verifier: string;
    grant_type: "authorization_code";
    redirect_uri: string;
}>;

declare const zJwk: z.ZodObject<{
    alg: z.ZodOptional<z.ZodString>;
    crv: z.ZodOptional<z.ZodString>;
    d: z.ZodOptional<z.ZodString>;
    dp: z.ZodOptional<z.ZodString>;
    dq: z.ZodOptional<z.ZodString>;
    e: z.ZodOptional<z.ZodString>;
    ext: z.ZodOptional<z.ZodBoolean>;
    k: z.ZodOptional<z.ZodString>;
    key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
    kid: z.ZodOptional<z.ZodString>;
    kty: z.ZodString;
    n: z.ZodOptional<z.ZodString>;
    oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
        d: z.ZodOptional<z.ZodString>;
        r: z.ZodOptional<z.ZodString>;
        t: z.ZodOptional<z.ZodString>;
    }, z.core.$loose>>>;
    p: z.ZodOptional<z.ZodString>;
    q: z.ZodOptional<z.ZodString>;
    qi: z.ZodOptional<z.ZodString>;
    use: z.ZodOptional<z.ZodString>;
    x: z.ZodOptional<z.ZodString>;
    x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
    x5t: z.ZodOptional<z.ZodString>;
    "x5t#S256": z.ZodOptional<z.ZodString>;
    x5u: z.ZodOptional<z.ZodString>;
    y: z.ZodOptional<z.ZodString>;
}, z.core.$loose>;
type Jwk = z.infer<typeof zJwk>;
declare const zJwkSet: z.ZodObject<{
    keys: z.ZodArray<z.ZodObject<{
        alg: z.ZodOptional<z.ZodString>;
        crv: z.ZodOptional<z.ZodString>;
        d: z.ZodOptional<z.ZodString>;
        dp: z.ZodOptional<z.ZodString>;
        dq: z.ZodOptional<z.ZodString>;
        e: z.ZodOptional<z.ZodString>;
        ext: z.ZodOptional<z.ZodBoolean>;
        k: z.ZodOptional<z.ZodString>;
        key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
        kid: z.ZodOptional<z.ZodString>;
        kty: z.ZodString;
        n: z.ZodOptional<z.ZodString>;
        oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
            d: z.ZodOptional<z.ZodString>;
            r: z.ZodOptional<z.ZodString>;
            t: z.ZodOptional<z.ZodString>;
        }, z.core.$loose>>>;
        p: z.ZodOptional<z.ZodString>;
        q: z.ZodOptional<z.ZodString>;
        qi: z.ZodOptional<z.ZodString>;
        use: z.ZodOptional<z.ZodString>;
        x: z.ZodOptional<z.ZodString>;
        x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
        x5t: z.ZodOptional<z.ZodString>;
        "x5t#S256": z.ZodOptional<z.ZodString>;
        x5u: z.ZodOptional<z.ZodString>;
        y: z.ZodOptional<z.ZodString>;
    }, z.core.$loose>>;
}, z.core.$loose>;
type JwkSet = z.infer<typeof zJwkSet>;

interface CreateAccessTokenResponseOptions {
    /**
     * Additional claims copied into both the access token JWT payload and token
     * response envelope.
     */
    additionalPayload?: Record<string, unknown>;
    /**
     * Intended recipient of the access token (`aud` claim).
     */
    audience: string;
    /**
     * Authorization server identifier (`iss` claim).
     */
    authorizationServer: string;
    /**
     * Runtime callbacks used to generate random values, compute JWK thumbprints,
     * and sign the access token JWT.
     */
    callbacks: Pick<CallbackContext, "generateRandom" | "hash" | "signJwt">;
    /**
     * OAuth client identifier (`client_id` claim).
     */
    clientId: string;
    /**
     * DPoP public key used to bind the access token (`cnf.jkt` claim).
     */
    dpop?: {
        jwk: Jwk;
    };
    /**
     * Access token lifetime in seconds, used for both `exp` and `expires_in`.
     */
    expiresInSeconds: number;
    /**
     * Optional "not before" timestamp in epoch seconds (`nbf` claim).
     */
    nbf?: number;
    /**
     * Reference time used for `iat` and `exp`. Defaults to current time.
     */
    now?: Date;
    /**
     * Optional refresh token included in the OAuth token response.
     */
    refreshToken?: string;
    /**
     * Optional scope string included in both the access token JWT payload and token
     * response envelope.
     */
    scope?: string;
    /**
     * Signer used to produce the access token JWT.
     */
    signer: JwtSigner$1;
    /**
     * Subject identifier represented by the access token (`sub` claim).
     */
    subject: string;
    /**
     * Token type returned in the OAuth token response.
     * NOTE: When using `Bearer` it is supposed to be used only for PDND Interoperability API, not for credential issuance flows.
     */
    tokenType: "Bearer" | "DPoP";
}
/**
 * Creates an OAuth 2.0 access token response where `access_token` is a signed
 * JWT access token profile (`typ=at+jwt`) and `token_type` is `DPoP` or `Bearer`.
 *
 * The JWT payload always includes `aud`, `iss`, `sub`, `client_id`, `iat`,
 * `exp`, and a random `jti`. When `dpop` is provided, `cnf.jkt` is added using
 * the SHA-256 JWK thumbprint.
 *
 * @param options - Access token response creation options.
 * @returns OAuth token response with a signed access token JWT.
 * @throws {CreateTokenResponseError} If DPoP binding is required but missing, or if response creation fails, including validation failures from the generated JWT header or payload.
 * @throws {ValidationError} If the generated JWT header or payload fails validation.
 */
declare function createAccessTokenResponse(options: CreateAccessTokenResponseOptions): Promise<{
    [x: string]: unknown;
    access_token: string;
    token_type: "Bearer" | "DPoP";
    authorization_details?: {
        [x: string]: unknown;
        type: "openid_credential";
        credential_configuration_id?: string | undefined;
        credential_identifiers?: string[] | undefined;
    }[] | undefined;
    expires_in?: number | undefined;
    refresh_token?: string | undefined;
}>;

declare const zAccessTokenRequest: z$1.ZodDiscriminatedUnion<[z$1.ZodObject<{
    code: z$1.ZodString;
    code_verifier: z$1.ZodString;
    grant_type: z$1.ZodLiteral<"authorization_code">;
    redirect_uri: z$1.ZodString;
}, z$1.core.$strip>, z$1.ZodObject<{
    grant_type: z$1.ZodLiteral<"refresh_token">;
    refresh_token: z$1.ZodString;
    scope: z$1.ZodOptional<z$1.ZodString>;
}, z$1.core.$strip>], "grant_type">;
type AccessTokenRequest = z$1.infer<typeof zAccessTokenRequest>;
type AuthorizationCodeGrantType = Extract<AccessTokenRequest, {
    grant_type: "authorization_code";
}>;
type RefreshTokenGrantType = Extract<AccessTokenRequest, {
    grant_type: "refresh_token";
}>;
declare const zAccessTokenResponse: z$1.ZodObject<{
    access_token: z$1.ZodString;
    authorization_details: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
        credential_configuration_id: z$1.ZodOptional<z$1.ZodString>;
        credential_identifiers: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
        type: z$1.ZodLiteral<"openid_credential">;
    }, z$1.core.$loose>>>;
    expires_in: z$1.ZodOptional<z$1.ZodNumber>;
    refresh_token: z$1.ZodOptional<z$1.ZodString>;
    token_type: z$1.ZodUnion<readonly [z$1.ZodLiteral<"Bearer">, z$1.ZodLiteral<"DPoP">]>;
}, z$1.core.$loose>;
type AccessTokenResponse = z$1.infer<typeof zAccessTokenResponse>;
declare const zAccessTokenProfileJwtHeader: z$1.ZodObject<{
    typ: z$1.ZodEnum<{
        "application/at+jwt": "application/at+jwt";
        "at+jwt": "at+jwt";
    }>;
    alg: z$1.ZodString;
    jwk: z$1.ZodOptional<z$1.ZodObject<{
        alg: z$1.ZodOptional<z$1.ZodString>;
        crv: z$1.ZodOptional<z$1.ZodString>;
        d: z$1.ZodOptional<z$1.ZodString>;
        dp: z$1.ZodOptional<z$1.ZodString>;
        dq: z$1.ZodOptional<z$1.ZodString>;
        e: z$1.ZodOptional<z$1.ZodString>;
        ext: z$1.ZodOptional<z$1.ZodBoolean>;
        k: z$1.ZodOptional<z$1.ZodString>;
        key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
        kid: z$1.ZodOptional<z$1.ZodString>;
        kty: z$1.ZodString;
        n: z$1.ZodOptional<z$1.ZodString>;
        oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
            d: z$1.ZodOptional<z$1.ZodString>;
            r: z$1.ZodOptional<z$1.ZodString>;
            t: z$1.ZodOptional<z$1.ZodString>;
        }, z$1.core.$loose>>>;
        p: z$1.ZodOptional<z$1.ZodString>;
        q: z$1.ZodOptional<z$1.ZodString>;
        qi: z$1.ZodOptional<z$1.ZodString>;
        use: z$1.ZodOptional<z$1.ZodString>;
        x: z$1.ZodOptional<z$1.ZodString>;
        x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
        x5t: z$1.ZodOptional<z$1.ZodString>;
        "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
        x5u: z$1.ZodOptional<z$1.ZodString>;
        y: z$1.ZodOptional<z$1.ZodString>;
    }, z$1.core.$loose>>;
    kid: z$1.ZodOptional<z$1.ZodString>;
    trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
    x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
}, z$1.core.$loose>;
type AccessTokenProfileJwtHeader = z$1.infer<typeof zAccessTokenProfileJwtHeader>;
declare const zAccessTokenProfileJwtPayload: z$1.ZodObject<{
    aud: z$1.ZodString;
    client_id: z$1.ZodString;
    cnf: z$1.ZodOptional<z$1.ZodObject<{
        jkt: z$1.ZodString;
    }, z$1.core.$strip>>;
    exp: z$1.ZodNumber;
    iat: z$1.ZodNumber;
    iss: z$1.ZodString;
    jti: z$1.ZodString;
    nbf: z$1.ZodOptional<z$1.ZodNumber>;
    scope: z$1.ZodOptional<z$1.ZodString>;
    sub: z$1.ZodString;
    nonce: z$1.ZodOptional<z$1.ZodString>;
    status: z$1.ZodOptional<z$1.ZodRecord<z$1.ZodString, z$1.ZodAny>>;
    trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
}, z$1.core.$loose>;
type AccessTokenProfileJwtPayload = z$1.infer<typeof zAccessTokenProfileJwtPayload>;

interface FetchTokenResponseOptions {
    /**
     * The endpoint URL where the access token request will be sent
     * This should be the authorization server's token endpoint
     */
    accessTokenEndpoint: string;
    /**
     * The access token request payload
     */
    accessTokenRequest: AccessTokenRequest;
    /**
     * Callbacks to use for requesting access token
     */
    callbacks: Pick<CallbackContext, "fetch">;
    /**
     * The client attestation Demonstration of Proof-of-Possession (DPoP) token
     * Used for OAuth-Client-Attestation-PoP header to prove possession of the client key
     */
    clientAttestationDPoP: string;
    /**
     * DPoP proof for the token request
     */
    dPoP: string;
    /**
     * The wallet attestation JWT that proves the client's identity and capabilities
     * Used for OAuth-Client-Attestation header
     */
    walletAttestation: string;
}
/**
 * Sends an access token request to the authorization server and returns the response
 *
 * @param options - Configuration options for the access token request
 * @returns Promise that resolves to the parsed access token response
 * @throws {UnexpectedStatusCodeError} When the server returns a non-200 status code
 * @throws {ValidationError} When the response cannot be parsed as a valid access token response
 * @throws {FetchTokenResponseError} When an unexpected error occurs during the request
 */
declare function fetchTokenResponse(options: FetchTokenResponseOptions): Promise<AccessTokenResponse>;
/**
 * Converts an access token request object into URL-encoded form parameters.
 *
 * Object values are JSON-stringified so structured extension parameters such as
 * `authorization_details` can be sent in `application/x-www-form-urlencoded` requests.
 *
 * @param data - Access token request payload.
 * @returns URLSearchParams containing all defined request fields.
 */
declare function toURLSearchParams(data: AccessTokenRequest): URLSearchParams;

declare const zAuthorizationCodeGrantIdentifier: z$1.ZodLiteral<"authorization_code">;
declare const authorizationCodeGrantIdentifier: "authorization_code";
type AuthorizationCodeGrantIdentifier = z$1.infer<typeof zAuthorizationCodeGrantIdentifier>;
declare const zRefreshTokenGrantIdentifier: z$1.ZodLiteral<"refresh_token">;
declare const refreshTokenGrantIdentifier: "refresh_token";
type RefreshTokenGrantIdentifier = z$1.infer<typeof zRefreshTokenGrantIdentifier>;

interface ParsedAccessTokenAuthorizationCodeRequestGrant {
    code: string;
    grantType: AuthorizationCodeGrantIdentifier;
}
interface ParsedAccessTokenRefreshTokenRequestGrant {
    grantType: RefreshTokenGrantIdentifier;
    refreshToken: string;
}
type ParsedAccessTokenRequestGrant = ParsedAccessTokenAuthorizationCodeRequestGrant | ParsedAccessTokenRefreshTokenRequestGrant;
interface ParseAccessTokenRequestResult {
    accessTokenRequest: AccessTokenRequest;
    /**
     * The client attestation jwts from the access token request headers
     */
    clientAttestation: {
        clientAttestationPopJwt: string;
        walletAttestationJwt: string;
    };
    /**
     * The dpop jwt from the access token request headers
     */
    dpop: {
        jwt: string;
    };
    grant: ParsedAccessTokenRequestGrant;
    /**
     * The pkce code verifier from the access token request
     */
    pkceCodeVerifier?: string;
}
interface ParseAccessTokenRequestOptions {
    /**
     * The access token request as a JSON object. Your server should decode the
     * `x-www-url-form-urlencoded` body into an object (e.g. using `bodyParser.urlEncoded()` in express)
     */
    accessTokenRequest: Record<string, unknown>;
    request: RequestLike$1;
}
/**
 * Parses and validates an OAuth 2.0 access token request.
 *
 * This function performs the following steps:
 * 1. Validates the request body against the access token request schema
 * 2. Extracts and validates grant-specific parameters (authorization code or refresh token)
 * 3. Parses security headers (DPoP and Client Attestation JWTs)
 * 4. Extracts PKCE code verifier if present
 *
 * Note: This function only parses and validates the structure of the request.
 * Cryptographic verification of JWTs and tokens should be performed separately.
 *
 * @param options - Configuration object containing the access token request body and HTTP request
 * @returns Parsed access token request with typed grant parameters and extracted security headers
 * @throws {Oauth2Error} If validation fails or required parameters are missing
 *
 * @example
 * ```typescript
 * const result = parseAccessTokenRequest({
 *   accessTokenRequest: {
 *     grant_type: 'authorization_code',
 *     code: 'auth_code_123',
 *     client_id: 'client_123',
 *     code_verifier: 'verifier_xyz'
 *   },
 *   request: httpRequest
 * });
 * ```
 */
declare function parseAccessTokenRequest(options: ParseAccessTokenRequestOptions): ParseAccessTokenRequestResult;

interface VerifyClientAttestationPopJwtOptions {
    /**
     * The issuer identifier of the authorization server handling the client attestation
     */
    authorizationServer: string;
    /**
     * Callbacks used for verifying client attestation pop jwt.
     */
    callbacks: Pick<CallbackContext, "verifyJwt">;
    /**
     * The compact client attestation pop jwt.
     */
    clientAttestationPopJwt: string;
    /**
     * The public JWK to verify the client attestation pop jwt.
     */
    clientAttestationPublicJwk: Jwk;
    /**
     * Expected nonce in the payload. If not provided the nonce won't be validated.
     */
    expectedNonce?: string;
    /**
     * The current time to use when verifying the JWTs.
     * If not provided current time will be used.
     *
     * @default new Date()
     */
    now?: Date;
}
type VerifiedClientAttestationPopJwt = Awaited<ReturnType<typeof verifyClientAttestationPopJwt>>;
/**
 * Verifies a client attestation proof-of-possession JWT.
 *
 * @param options - Verification options.
 * @param options.authorizationServer - Expected audience, usually the Authorization Server issuer.
 * @param options.callbacks - Callback used to verify the JWT signature.
 * @param options.clientAttestationPopJwt - Compact client attestation PoP JWT.
 * @param options.clientAttestationPublicJwk - Public JWK from the wallet/client attestation confirmation claim.
 * @param options.expectedNonce - Optional nonce expected in the JWT payload.
 * @param options.now - Date used for temporal validation.
 * @returns Decoded JWT header, payload, and resolved signer.
 * @throws {Oauth2Error} If decoding, algorithm validation, signature verification, or claim validation fails.
 */
declare function verifyClientAttestationPopJwt(options: VerifyClientAttestationPopJwtOptions): Promise<{
    header: {
        [x: string]: unknown;
        typ: "oauth-client-attestation-pop+jwt";
        alg: string;
        jwk?: {
            [x: string]: unknown;
            kty: string;
            alg?: string | undefined;
            crv?: string | undefined;
            d?: string | undefined;
            dp?: string | undefined;
            dq?: string | undefined;
            e?: string | undefined;
            ext?: boolean | undefined;
            k?: string | undefined;
            key_ops?: string[] | undefined;
            kid?: string | undefined;
            n?: string | undefined;
            oth?: {
                [x: string]: unknown;
                d?: string | undefined;
                r?: string | undefined;
                t?: string | undefined;
            }[] | undefined;
            p?: string | undefined;
            q?: string | undefined;
            qi?: string | undefined;
            use?: string | undefined;
            x?: string | undefined;
            x5c?: string[] | undefined;
            x5t?: string | undefined;
            "x5t#S256"?: string | undefined;
            x5u?: string | undefined;
            y?: string | undefined;
        } | undefined;
        kid?: string | undefined;
        trust_chain?: [string, ...string[]] | undefined;
        x5c?: string[] | undefined;
    };
    payload: {
        [x: string]: unknown;
        aud: string;
        iat: number;
        iss: string;
        jti: string;
        exp?: number | undefined;
        nonce?: string | undefined;
        cnf?: {
            [x: string]: unknown;
            jkt?: string | undefined;
            jwk?: {
                [x: string]: unknown;
                kty: string;
                alg?: string | undefined;
                crv?: string | undefined;
                d?: string | undefined;
                dp?: string | undefined;
                dq?: string | undefined;
                e?: string | undefined;
                ext?: boolean | undefined;
                k?: string | undefined;
                key_ops?: string[] | undefined;
                kid?: string | undefined;
                n?: string | undefined;
                oth?: {
                    [x: string]: unknown;
                    d?: string | undefined;
                    r?: string | undefined;
                    t?: string | undefined;
                }[] | undefined;
                p?: string | undefined;
                q?: string | undefined;
                qi?: string | undefined;
                use?: string | undefined;
                x?: string | undefined;
                x5c?: string[] | undefined;
                x5t?: string | undefined;
                "x5t#S256"?: string | undefined;
                x5u?: string | undefined;
                y?: string | undefined;
            } | undefined;
        } | undefined;
        nbf?: number | undefined;
        status?: Record<string, any> | undefined;
        trust_chain?: [string, ...string[]] | undefined;
    };
    signer: _openid4vc_oauth2.JwtSignerWithJwk;
}>;
interface BaseCreateClientAttestationPopJwtOptions<V extends ItWalletSpecsVersion> {
    /**
     * The audience authorization server identifier
     */
    authorizationServer: string;
    /**
     * Callback used for dpop
     * generateRandom is mandatory if jti is not provided
     */
    callbacks: Partial<Pick<CallbackContext, "generateRandom">> & Pick<CallbackContext, "signJwt">;
    /**
     * The client attestation to create the Pop for
     */
    clientAttestation: string;
    /**
     * The IT-Wallet SDK configuration, used to select the correct version-specific
     * payload shape for the client attestation PoP JWT.
     */
    config: IoWalletSdkConfig<V>;
    /**
     * Creation time of the JWT. If not provided the current date will be used
     */
    issuedAt?: Date;
    /**
     * Optional jti to set in the payload. If not provided a random one will be generated
     */
    jti?: string;
    /**
     * The signer of jwt. Only jwk signer allowed.
     *
     * If not provided, the signer will be derived based on the
     * `cnf.jwk` and `alg` in the client attestation.
     */
    signer?: JwtSignerJwk$1;
}
type NoClientAttestationPopJwtExtraOptions = Record<never, never>;
interface CreateClientAttestationPopJwtVersionOptions {
    [ItWalletSpecsVersion.V1_0]: {
        /**
         * Expiration time of the JWT.
         * If not provided, 1 minute will be added to `issuedAt`.
         */
        expiresAt?: Date;
    };
    [ItWalletSpecsVersion.V1_3]: NoClientAttestationPopJwtExtraOptions;
    [ItWalletSpecsVersion.V1_4]: NoClientAttestationPopJwtExtraOptions;
}
type CreateClientAttestationPopJwtExtraOptions<V extends ItWalletSpecsVersion> = [
    V
] extends [keyof CreateClientAttestationPopJwtVersionOptions] ? CreateClientAttestationPopJwtVersionOptions[V] : NoClientAttestationPopJwtExtraOptions;
type CreateClientAttestationPopJwtOptionsForVersion<V extends ItWalletSpecsVersion> = BaseCreateClientAttestationPopJwtOptions<V> & CreateClientAttestationPopJwtExtraOptions<V>;
type CreateClientAttestationPopJwtOptionsV1_0 = CreateClientAttestationPopJwtOptionsForVersion<ItWalletSpecsVersion.V1_0>;
type CreateClientAttestationPopJwtOptionsV1_3 = CreateClientAttestationPopJwtOptionsForVersion<ItWalletSpecsVersion.V1_3>;
type CreateClientAttestationPopJwtOptionsV1_4 = CreateClientAttestationPopJwtOptionsForVersion<ItWalletSpecsVersion.V1_4>;
type CreateClientAttestationPopJwtOptions = CreateClientAttestationPopJwtOptionsForVersion<ItWalletSpecsVersion>;
/**
 * Creates a client attestation proof-of-possession JWT.
 *
 * The signer is derived from the wallet/client attestation `cnf.jwk` when it is
 * not supplied explicitly.
 *
 * @param options - Client attestation PoP creation options.
 * @returns Compact signed client attestation PoP JWT.
 * @throws {Oauth2Error} If required attestation claims are missing, `jti` cannot be generated,
 * or signing/validation fails.
 */
declare function createClientAttestationPopJwt<V extends ItWalletSpecsVersion = ItWalletSpecsVersion>(options: CreateClientAttestationPopJwtOptionsForVersion<V>): Promise<string>;

interface ClientAttestationOptions {
    /**
     * The client attestation DPoP JWT provided in the request.
     */
    clientAttestationPopJwt: string;
    /**
     * Whether to ensure that the key used in client attestation confirmation
     * is the same key used for DPoP. This only has effect if both DPoP and client
     * attestations are present.
     *
     * @default false
     */
    ensureConfirmationKeyMatchesDpopKey?: boolean;
    /**
     * The wallet attestation JWT provided in the request.
     */
    walletAttestationJwt: string;
}
interface VerifyClientAttestationOptions {
    /**
     * The authorization server metadata.
     */
    authorizationServerMetadata: ItWalletAuthorizationServerMetadata;
    /**
     * Callbacks for hashing and JWT verification.
     */
    callbacks: Pick<CallbackContext, "hash" | "verifyJwt">;
    /**
     * The client attestation options.
     */
    clientAttestation: ClientAttestationOptions;
    /**
     * The IT-Wallet SDK configuration, used to select the correct version-specific
     * validation schema for the wallet attestation JWT.
     */
    config: IoWalletSdkConfig;
    /**
     * The DPoP JWK thumbprint value, if DPoP is being used in the request.
     */
    dpopJwkThumbprint?: string;
    /**
     * The current time to use when verifying the JWTs.
     * If not provided current time will be used.
     *
     * @default new Date()
     */
    now?: Date;
    /**
     * The client id provided in the authorization request, if any.
     *
     * Pass this when the authorization request includes a `client_id` parameter.
     * The function will verify that it matches the `sub` claim in the client attestation JWT.
     * If not provided, no client_id validation is performed.
     */
    requestClientId?: string;
}
/**
 * Verifies wallet attestation and client attestation PoP headers as a pair.
 *
 * @param options - Client attestation verification options.
 * @param options.authorizationServerMetadata - Authorization Server metadata used for issuer/audience checks.
 * @param options.callbacks - Hashing and JWT verification callbacks.
 * @param options.clientAttestation - Wallet attestation and PoP JWT values from the request.
 * @param options.config - IT-Wallet specification version used to validate the wallet attestation.
 * @param options.dpopJwkThumbprint - Optional DPoP JWK thumbprint to compare with the attestation key.
 * @param options.now - Date used for temporal validation.
 * @param options.requestClientId - Optional client_id that must match the attestation subject.
 * @returns Verified wallet attestation and client attestation PoP JWT data.
 * @throws {Oauth2Error} If required headers are missing or any attestation validation fails.
 */
declare function verifyClientAttestation(options: VerifyClientAttestationOptions): Promise<{
    clientAttestation: {
        header: {
            [x: string]: unknown;
            trust_chain: [string, ...string[]];
            typ: "oauth-client-attestation+jwt";
            alg: string;
            jwk?: {
                [x: string]: unknown;
                kty: string;
                alg?: string | undefined;
                crv?: string | undefined;
                d?: string | undefined;
                dp?: string | undefined;
                dq?: string | undefined;
                e?: string | undefined;
                ext?: boolean | undefined;
                k?: string | undefined;
                key_ops?: string[] | undefined;
                kid?: string | undefined;
                n?: string | undefined;
                oth?: {
                    [x: string]: unknown;
                    d?: string | undefined;
                    r?: string | undefined;
                    t?: string | undefined;
                }[] | undefined;
                p?: string | undefined;
                q?: string | undefined;
                qi?: string | undefined;
                use?: string | undefined;
                x?: string | undefined;
                x5c?: string[] | undefined;
                x5t?: string | undefined;
                "x5t#S256"?: string | undefined;
                x5u?: string | undefined;
                y?: string | undefined;
            } | undefined;
            kid?: string | undefined;
            x5c?: string[] | undefined;
        };
        payload: {
            [x: string]: unknown;
            aal: string;
            cnf: {
                jwk: {
                    [x: string]: unknown;
                    kty: string;
                    alg?: string | undefined;
                    crv?: string | undefined;
                    d?: string | undefined;
                    dp?: string | undefined;
                    dq?: string | undefined;
                    e?: string | undefined;
                    ext?: boolean | undefined;
                    k?: string | undefined;
                    key_ops?: string[] | undefined;
                    kid?: string | undefined;
                    n?: string | undefined;
                    oth?: {
                        [x: string]: unknown;
                        d?: string | undefined;
                        r?: string | undefined;
                        t?: string | undefined;
                    }[] | undefined;
                    p?: string | undefined;
                    q?: string | undefined;
                    qi?: string | undefined;
                    use?: string | undefined;
                    x?: string | undefined;
                    x5c?: string[] | undefined;
                    x5t?: string | undefined;
                    "x5t#S256"?: string | undefined;
                    x5u?: string | undefined;
                    y?: string | undefined;
                };
            };
            exp: number;
            iat: number;
            iss: string;
            sub: string;
            wallet_link?: string | undefined;
            wallet_name?: string | undefined;
            aud?: string | undefined;
            jti?: string | undefined;
            nbf?: number | undefined;
            nonce?: string | undefined;
            status?: Record<string, any> | undefined;
            trust_chain?: [string, ...string[]] | undefined;
        };
        signer: _openid4vc_oauth2.JwtSignerWithJwk;
    };
    clientAttestationPop: {
        header: {
            [x: string]: unknown;
            typ: "oauth-client-attestation-pop+jwt";
            alg: string;
            jwk?: {
                [x: string]: unknown;
                kty: string;
                alg?: string | undefined;
                crv?: string | undefined;
                d?: string | undefined;
                dp?: string | undefined;
                dq?: string | undefined;
                e?: string | undefined;
                ext?: boolean | undefined;
                k?: string | undefined;
                key_ops?: string[] | undefined;
                kid?: string | undefined;
                n?: string | undefined;
                oth?: {
                    [x: string]: unknown;
                    d?: string | undefined;
                    r?: string | undefined;
                    t?: string | undefined;
                }[] | undefined;
                p?: string | undefined;
                q?: string | undefined;
                qi?: string | undefined;
                use?: string | undefined;
                x?: string | undefined;
                x5c?: string[] | undefined;
                x5t?: string | undefined;
                "x5t#S256"?: string | undefined;
                x5u?: string | undefined;
                y?: string | undefined;
            } | undefined;
            kid?: string | undefined;
            trust_chain?: [string, ...string[]] | undefined;
            x5c?: string[] | undefined;
        };
        payload: {
            [x: string]: unknown;
            aud: string;
            iat: number;
            iss: string;
            jti: string;
            exp?: number | undefined;
            nonce?: string | undefined;
            cnf?: {
                [x: string]: unknown;
                jkt?: string | undefined;
                jwk?: {
                    [x: string]: unknown;
                    kty: string;
                    alg?: string | undefined;
                    crv?: string | undefined;
                    d?: string | undefined;
                    dp?: string | undefined;
                    dq?: string | undefined;
                    e?: string | undefined;
                    ext?: boolean | undefined;
                    k?: string | undefined;
                    key_ops?: string[] | undefined;
                    kid?: string | undefined;
                    n?: string | undefined;
                    oth?: {
                        [x: string]: unknown;
                        d?: string | undefined;
                        r?: string | undefined;
                        t?: string | undefined;
                    }[] | undefined;
                    p?: string | undefined;
                    q?: string | undefined;
                    qi?: string | undefined;
                    use?: string | undefined;
                    x?: string | undefined;
                    x5c?: string[] | undefined;
                    x5t?: string | undefined;
                    "x5t#S256"?: string | undefined;
                    x5u?: string | undefined;
                    y?: string | undefined;
                } | undefined;
            } | undefined;
            nbf?: number | undefined;
            status?: Record<string, any> | undefined;
            trust_chain?: [string, ...string[]] | undefined;
        };
        signer: _openid4vc_oauth2.JwtSignerWithJwk;
    };
}>;

interface BaseVerifyWalletAttestationJwtOptions {
    callbacks: Pick<CallbackContext, "verifyJwt">;
    now?: Date;
    walletAttestationJwt: string;
}
/**
 * Base options shared across all wallet attestation versions
 */
interface BaseWalletAttestationOptions {
    callbacks: Pick<CallbackContext, "hash" | "signJwt">;
    dpopJwkPublic: ClientAttestationJwtPayload["cnf"]["jwk"];
    expiresAt?: Date;
    issuer: string;
    walletLink?: string;
    walletName?: string;
}
declare const zOauthClientAttestationHeader: z.ZodLiteral<"OAuth-Client-Attestation">;
declare const oauthClientAttestationHeader: "OAuth-Client-Attestation";
declare const zOauthClientAttestationPopHeader: z.ZodLiteral<"OAuth-Client-Attestation-PoP">;
declare const oauthClientAttestationPopHeader: "OAuth-Client-Attestation-PoP";

interface VerifyWalletAttestationJwtOptionsV1_0 extends BaseVerifyWalletAttestationJwtOptions {
    config: IoWalletSdkConfig<ItWalletSpecsVersion.V1_0>;
}
type VerifiedWalletAttestationJwtV1_0 = Awaited<ReturnType<typeof verifyWalletAttestationJwt$3>>;
/**
 * Verifies an IT-Wallet v1.0 wallet attestation JWT.
 *
 * @param options - v1.0 verification options.
 * @returns Decoded and verified wallet attestation JWT data.
 * @throws {ValidationError} If the JWT header or payload does not satisfy the v1.0 schema.
 * @throws {Oauth2JwtParseError} If the JWT cannot be decoded.
 * @throws {Oauth2JwtVerificationError} If signature verification fails.
 */
declare function verifyWalletAttestationJwt$3(options: VerifyWalletAttestationJwtOptionsV1_0): Promise<{
    header: {
        [x: string]: unknown;
        trust_chain: [string, ...string[]];
        typ: "oauth-client-attestation+jwt";
        alg: string;
        jwk?: {
            [x: string]: unknown;
            kty: string;
            alg?: string | undefined;
            crv?: string | undefined;
            d?: string | undefined;
            dp?: string | undefined;
            dq?: string | undefined;
            e?: string | undefined;
            ext?: boolean | undefined;
            k?: string | undefined;
            key_ops?: string[] | undefined;
            kid?: string | undefined;
            n?: string | undefined;
            oth?: {
                [x: string]: unknown;
                d?: string | undefined;
                r?: string | undefined;
                t?: string | undefined;
            }[] | undefined;
            p?: string | undefined;
            q?: string | undefined;
            qi?: string | undefined;
            use?: string | undefined;
            x?: string | undefined;
            x5c?: string[] | undefined;
            x5t?: string | undefined;
            "x5t#S256"?: string | undefined;
            x5u?: string | undefined;
            y?: string | undefined;
        } | undefined;
        kid?: string | undefined;
        x5c?: string[] | undefined;
    };
    payload: {
        [x: string]: unknown;
        aal: string;
        cnf: {
            jwk: {
                [x: string]: unknown;
                kty: string;
                alg?: string | undefined;
                crv?: string | undefined;
                d?: string | undefined;
                dp?: string | undefined;
                dq?: string | undefined;
                e?: string | undefined;
                ext?: boolean | undefined;
                k?: string | undefined;
                key_ops?: string[] | undefined;
                kid?: string | undefined;
                n?: string | undefined;
                oth?: {
                    [x: string]: unknown;
                    d?: string | undefined;
                    r?: string | undefined;
                    t?: string | undefined;
                }[] | undefined;
                p?: string | undefined;
                q?: string | undefined;
                qi?: string | undefined;
                use?: string | undefined;
                x?: string | undefined;
                x5c?: string[] | undefined;
                x5t?: string | undefined;
                "x5t#S256"?: string | undefined;
                x5u?: string | undefined;
                y?: string | undefined;
            };
        };
        exp: number;
        iat: number;
        iss: string;
        sub: string;
        wallet_link?: string | undefined;
        wallet_name?: string | undefined;
        aud?: string | undefined;
        jti?: string | undefined;
        nbf?: number | undefined;
        nonce?: string | undefined;
        status?: Record<string, any> | undefined;
        trust_chain?: [string, ...string[]] | undefined;
    };
    signer: _openid4vc_oauth2.JwtSignerWithJwk;
}>;

interface VerifyWalletAttestationJwtOptionsV1_3 extends BaseVerifyWalletAttestationJwtOptions {
    config: IoWalletSdkConfig<ItWalletSpecsVersion.V1_3>;
}
type VerifiedWalletAttestationJwtV1_3 = Awaited<ReturnType<typeof verifyWalletAttestationJwt$2>>;
/**
 * Verifies an IT-Wallet v1.3 wallet attestation JWT.
 *
 * @param options - v1.3 verification options.
 * @returns Decoded and verified wallet attestation JWT data.
 * @throws {ValidationError} If the JWT header or payload does not satisfy the v1.3 schema.
 * @throws {Oauth2JwtParseError} If the JWT cannot be decoded.
 * @throws {Oauth2JwtVerificationError} If signature verification fails.
 */
declare function verifyWalletAttestationJwt$2(options: VerifyWalletAttestationJwtOptionsV1_3): Promise<{
    header: {
        [x: string]: unknown;
        typ: "oauth-client-attestation+jwt";
        x5c: string[];
        alg: string;
        trust_chain?: [string, ...string[]] | undefined;
        jwk?: {
            [x: string]: unknown;
            kty: string;
            alg?: string | undefined;
            crv?: string | undefined;
            d?: string | undefined;
            dp?: string | undefined;
            dq?: string | undefined;
            e?: string | undefined;
            ext?: boolean | undefined;
            k?: string | undefined;
            key_ops?: string[] | undefined;
            kid?: string | undefined;
            n?: string | undefined;
            oth?: {
                [x: string]: unknown;
                d?: string | undefined;
                r?: string | undefined;
                t?: string | undefined;
            }[] | undefined;
            p?: string | undefined;
            q?: string | undefined;
            qi?: string | undefined;
            use?: string | undefined;
            x?: string | undefined;
            x5c?: string[] | undefined;
            x5t?: string | undefined;
            "x5t#S256"?: string | undefined;
            x5u?: string | undefined;
            y?: string | undefined;
        } | undefined;
        kid?: string | undefined;
    };
    payload: {
        [x: string]: unknown;
        cnf: {
            jwk: {
                [x: string]: unknown;
                kty: string;
                alg?: string | undefined;
                crv?: string | undefined;
                d?: string | undefined;
                dp?: string | undefined;
                dq?: string | undefined;
                e?: string | undefined;
                ext?: boolean | undefined;
                k?: string | undefined;
                key_ops?: string[] | undefined;
                kid?: string | undefined;
                n?: string | undefined;
                oth?: {
                    [x: string]: unknown;
                    d?: string | undefined;
                    r?: string | undefined;
                    t?: string | undefined;
                }[] | undefined;
                p?: string | undefined;
                q?: string | undefined;
                qi?: string | undefined;
                use?: string | undefined;
                x?: string | undefined;
                x5c?: string[] | undefined;
                x5t?: string | undefined;
                "x5t#S256"?: string | undefined;
                x5u?: string | undefined;
                y?: string | undefined;
            };
        };
        exp: number;
        iat: number;
        iss: string;
        sub: string;
        nbf?: number | undefined;
        status?: {
            status_list: {
                idx: number;
                uri: string;
            };
        } | undefined;
        wallet_link?: string | undefined;
        wallet_name?: string | undefined;
        aud?: string | undefined;
        jti?: string | undefined;
        nonce?: string | undefined;
        trust_chain?: [string, ...string[]] | undefined;
    };
    signer: _openid4vc_oauth2.JwtSignerWithJwk;
}>;

interface VerifyWalletAttestationJwtOptionsV1_4 extends BaseVerifyWalletAttestationJwtOptions {
    config: IoWalletSdkConfig<ItWalletSpecsVersion.V1_4>;
}
type VerifiedWalletAttestationJwtV1_4 = Awaited<ReturnType<typeof verifyWalletAttestationJwt$1>>;
/**
 * Verifies an IT-Wallet v1.4 wallet attestation JWT.
 *
 * @param options - v1.4 verification options.
 * @returns Decoded and verified wallet attestation JWT data.
 * @throws {ValidationError} If the JWT header or payload does not satisfy the v1.4 schema.
 * @throws {Oauth2JwtParseError} If the JWT cannot be decoded.
 * @throws {Oauth2JwtVerificationError} If signature verification fails.
 */
declare function verifyWalletAttestationJwt$1(options: VerifyWalletAttestationJwtOptionsV1_4): Promise<{
    header: {
        [x: string]: unknown;
        typ: "oauth-client-attestation+jwt";
        x5c: string[];
        alg: string;
        trust_chain?: [string, ...string[]] | undefined;
        jwk?: {
            [x: string]: unknown;
            kty: string;
            alg?: string | undefined;
            crv?: string | undefined;
            d?: string | undefined;
            dp?: string | undefined;
            dq?: string | undefined;
            e?: string | undefined;
            ext?: boolean | undefined;
            k?: string | undefined;
            key_ops?: string[] | undefined;
            kid?: string | undefined;
            n?: string | undefined;
            oth?: {
                [x: string]: unknown;
                d?: string | undefined;
                r?: string | undefined;
                t?: string | undefined;
            }[] | undefined;
            p?: string | undefined;
            q?: string | undefined;
            qi?: string | undefined;
            use?: string | undefined;
            x?: string | undefined;
            x5c?: string[] | undefined;
            x5t?: string | undefined;
            "x5t#S256"?: string | undefined;
            x5u?: string | undefined;
            y?: string | undefined;
        } | undefined;
        kid?: string | undefined;
    };
    payload: {
        [x: string]: unknown;
        cnf: {
            jwk: {
                [x: string]: unknown;
                kty: string;
                alg?: string | undefined;
                crv?: string | undefined;
                d?: string | undefined;
                dp?: string | undefined;
                dq?: string | undefined;
                e?: string | undefined;
                ext?: boolean | undefined;
                k?: string | undefined;
                key_ops?: string[] | undefined;
                kid?: string | undefined;
                n?: string | undefined;
                oth?: {
                    [x: string]: unknown;
                    d?: string | undefined;
                    r?: string | undefined;
                    t?: string | undefined;
                }[] | undefined;
                p?: string | undefined;
                q?: string | undefined;
                qi?: string | undefined;
                use?: string | undefined;
                x?: string | undefined;
                x5c?: string[] | undefined;
                x5t?: string | undefined;
                "x5t#S256"?: string | undefined;
                x5u?: string | undefined;
                y?: string | undefined;
            };
        };
        exp: number;
        iat: number;
        iss: string;
        status: {
            status_list: {
                idx: number;
                uri: string;
            };
        };
        sub: string;
        wallet_link: string;
        wallet_name: string;
        eudi_wallet_info?: {
            general_info: {
                wallet_provider_name: string;
                wallet_solution_certification_information: string;
                wallet_solution_id: string;
                wallet_solution_version: string;
            };
        } | undefined;
        nbf?: number | undefined;
        aud?: string | undefined;
        jti?: string | undefined;
        nonce?: string | undefined;
        trust_chain?: [string, ...string[]] | undefined;
    };
    signer: _openid4vc_oauth2.JwtSignerWithJwk;
}>;

type VerifiedWalletAttestationJwt = VerifiedWalletAttestationJwtV1_0 | VerifiedWalletAttestationJwtV1_3 | VerifiedWalletAttestationJwtV1_4;
type VerifyWalletAttestationJwtOptions = VerifyWalletAttestationJwtOptionsV1_0 | VerifyWalletAttestationJwtOptionsV1_3 | VerifyWalletAttestationJwtOptionsV1_4;
/**
 * Verifies a wallet/client attestation JWT according to the configured IT-Wallet version.
 *
 * @param options - Version-specific wallet attestation verification options.
 * @returns Decoded and verified wallet attestation data for the configured version.
 * @throws {ValidationError} If JWT header or payload validation fails.
 * @throws {Oauth2JwtParseError} If the attestation JWT cannot be decoded.
 * @throws {Oauth2JwtVerificationError} If signature verification fails.
 * @throws {ItWalletSpecsVersionError} If the configured version is unsupported.
 */
declare function verifyWalletAttestationJwt(options: VerifyWalletAttestationJwtOptionsV1_0): Promise<VerifiedWalletAttestationJwtV1_0>;
declare function verifyWalletAttestationJwt(options: VerifyWalletAttestationJwtOptionsV1_3): Promise<VerifiedWalletAttestationJwtV1_3>;
declare function verifyWalletAttestationJwt(options: VerifyWalletAttestationJwtOptionsV1_4): Promise<VerifiedWalletAttestationJwtV1_4>;
/**
 * Extracts wallet attestation and PoP JWT header values from request headers.
 *
 * @param headers - Request headers to inspect.
 * @returns Parsed header values when both are present, `{ valid: true }` when neither is present,
 * or `{ valid: false }` when the pair is incomplete or malformed.
 */
declare function extractClientAttestationJwtsFromHeaders(headers: FetchHeaders): {
    clientAttestationPopHeader: string;
    valid: true;
    walletAttestationHeader: string;
} | {
    clientAttestationPopHeader?: undefined;
    valid: true;
    walletAttestationHeader?: undefined;
} | {
    valid: false;
};

declare const PkceCodeChallengeMethod: {
    readonly Plain: "plain";
    readonly S256: "S256";
};
type PkceCodeChallengeMethod = (typeof PkceCodeChallengeMethod)[keyof typeof PkceCodeChallengeMethod];
interface CreatePkceOptions {
    /**
     * Also allows string values so it can be directly passed from the
     * 'code_challenge_methods_supported' metadata parameter
     */
    allowedCodeChallengeMethods?: (PkceCodeChallengeMethod | string)[];
    callbacks: Pick<CallbackContext, "generateRandom" | "hash">;
    /**
     * Code verifier to use. If not provided a value will be generated.
     */
    codeVerifier?: string;
}
interface CreatePkceReturn {
    codeChallenge: string;
    codeChallengeMethod: PkceCodeChallengeMethod;
    codeVerifier: string;
}
/**
 * Creates a PKCE code verifier and challenge pair.
 *
 * @param options - PKCE creation options.
 * @param options.allowedCodeChallengeMethods - Code challenge methods supported by the server.
 * @param options.callbacks - Random generation and hashing callbacks.
 * @param options.codeVerifier - Optional existing verifier; generated when omitted.
 * @returns Generated verifier, challenge, and selected challenge method.
 * @throws {Oauth2Error} If no challenge method is available or the selected method is unsupported.
 */
declare function createPkce(options: CreatePkceOptions): Promise<CreatePkceReturn>;
interface VerifyPkceOptions {
    callbacks: Pick<CallbackContext, "hash">;
    codeChallenge: string;
    codeChallengeMethod: PkceCodeChallengeMethod;
    /**
     * secure random code verifier
     */
    codeVerifier: string;
}
/**
 * Verifies that a PKCE code verifier matches a stored code challenge.
 *
 * @param options - PKCE verification options.
 * @param options.callbacks - Hashing callback.
 * @param options.codeChallenge - Expected code challenge.
 * @param options.codeChallengeMethod - Method used to compute the challenge.
 * @param options.codeVerifier - Verifier supplied by the client.
 * @returns Resolves when the verifier matches the challenge.
 * @throws {Oauth2Error} If the verifier does not match or the challenge method is unsupported.
 */
declare function verifyPkce(options: VerifyPkceOptions): Promise<void>;

interface VerifyAccessTokenRequestPkce {
    codeChallenge: string;
    codeChallengeMethod: PkceCodeChallengeMethod;
    codeVerifier: string;
}
interface VerifyAccessTokenRequestDpop {
    /**
     * Allowed dpop signing alg values. If not provided
     * any alg values are allowed and it's up to the `verifyJwtCallback`
     * to handle the alg.
     */
    allowedSigningAlgs?: string[];
    /**
     * The expected DPoP nonce value that must appear in the `nonce` claim of the DPoP proof JWT.
     *
     * AS implementations **SHOULD** issue server-provided nonces (via the `DPoP-Nonce` response
     * header) and pass the expected value here to prevent pre-generated DPoP proofs from being
     * reused across requests within the `iat` window.
     *
     * See RFC 9449 §8 for the full nonce issuance flow.
     */
    expectedNonce?: string;
    /**
     * The dpop jwt from the access token request
     */
    jwt: string;
}
interface VerifyAccessTokenRequestOptions {
    /**
     * The access token request to verify
     */
    accessTokenRequest: AccessTokenRequest;
    /**
     * The authorization server metadata
     */
    authorizationServerMetadata: ItWalletAuthorizationServerMetadata;
    /**
     * Callbacks used during verification
     */
    callbacks: Pick<CallbackContext, "hash" | "verifyJwt">;
    /**
     * Options for verifying the client attestation
     */
    clientAttestation: ClientAttestationOptions;
    /**
     * The expiration date of the authorization code
     */
    codeExpiresAt?: Date;
    config: IoWalletSdkConfig;
    /**
     * The dpop verification options
     */
    dpop: VerifyAccessTokenRequestDpop;
    /**
     * The expected authorization code
     */
    expectedCode: string;
    /**
     * The parsed authorization code grant
     */
    grant: ParsedAccessTokenAuthorizationCodeRequestGrant;
    /**
     * The current time to use when verifying the JWTs.
     * If not provided current time will be used.
     *
     * @default new Date()
     */
    now?: Date;
    /**
     * The pkce options including code verifier, challenge and method
     */
    pkce: VerifyAccessTokenRequestPkce;
    /**
     * The HTTP request information
     */
    request: RequestLike$1;
}
interface VerifyAccessTokenRequestResult {
    clientAttestation: {
        clientAttestation: VerifiedWalletAttestationJwt;
        clientAttestationPop: VerifiedClientAttestationPopJwt;
    };
    dpop: {
        jwk: Jwk;
        /**
         * base64url encoding of the JWK SHA-256 Thumbprint (according to [RFC7638])
         * of the DPoP public key (in JWK format)
         */
        jwkThumbprint: string;
    };
}
/**
 * Verifies an authorization code token request by validating PKCE, DPoP, and client attestation.
 *
 * This function performs comprehensive validation of an OAuth 2.0 authorization code token request
 * according to Italian IT-Wallet specifications, including:
 * - PKCE code verifier validation against the stored code challenge
 * - DPoP proof JWT verification and JWK thumbprint extraction
 * - Client attestation JWT and attestation PoP JWT verification
 * - Authorization code validity and expiration checks
 *
 * @param options - Configuration options for token request verification
 * @returns A promise that resolves with verified client attestation and DPoP information
 * @throws {Oauth2Error} If the authorization code is invalid or expired
 * @throws {Oauth2Error} If PKCE verification fails
 * @throws {Oauth2Error} If DPoP verification fails
 * @throws {Oauth2Error} If client attestation verification fails
 *
 * @example
 * ```typescript
 * const result = await verifyAccessTokenRequest({
 *   accessTokenRequest: parsedRequest,
 *   authorizationServerMetadata: metadata,
 *   callbacks: { hash, verifyJwt },
 *   clientAttestation: { jwt: "...", popJwt: "..." },
 *   codeExpiresAt: new Date(Date.now() + 600000),
 *   dpop: {
 *     allowedSigningAlgs: ["ES256"],
 *     expectedNonce: "server-issued-nonce",
 *     jwt: dpopJwt,
 *   },
 *   expectedCode: "auth_code_123",
 *   grant: parsedGrant,
 *   pkce: { codeChallenge, codeChallengeMethod: "S256", codeVerifier },
 *   request: httpRequest,
 * });
 * ```
 */
declare function verifyAccessTokenRequest(options: VerifyAccessTokenRequestOptions): Promise<VerifyAccessTokenRequestResult>;

declare const zAuthorizationRequestV1_0: z.ZodObject<{
    authorization_details: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
        credential_configuration_id: z.ZodString;
        type: z.ZodLiteral<"openid_credential">;
    }, z.core.$strip>, z.ZodObject<{
        challenge_method: z.ZodLiteral<"mrtd+ias">;
        challenge_redirect_uri: z.ZodURL;
        idphinting: z.ZodURL;
        type: z.ZodLiteral<"it_l2+document_proof">;
    }, z.core.$strip>], "type">>>;
    client_id: z.ZodString;
    code_challenge: z.ZodString;
    code_challenge_method: z.ZodString;
    issuer_state: z.ZodOptional<z.ZodString>;
    jti: z.ZodString;
    redirect_uri: z.ZodURL;
    response_type: z.ZodString;
    scope: z.ZodOptional<z.ZodString>;
    state: z.ZodString;
    response_mode: z.ZodString;
}, z.core.$loose>;
type AuthorizationRequestV1_0 = z.infer<typeof zAuthorizationRequestV1_0>;
declare const zAuthorizationRequestV1_3: z.ZodObject<{
    authorization_details: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
        credential_configuration_id: z.ZodString;
        type: z.ZodLiteral<"openid_credential">;
    }, z.core.$strip>, z.ZodObject<{
        challenge_method: z.ZodLiteral<"mrtd+ias">;
        challenge_redirect_uri: z.ZodURL;
        idphinting: z.ZodURL;
        type: z.ZodLiteral<"it_l2+document_proof">;
    }, z.core.$strip>], "type">>>;
    client_id: z.ZodString;
    code_challenge: z.ZodString;
    code_challenge_method: z.ZodString;
    issuer_state: z.ZodOptional<z.ZodString>;
    jti: z.ZodString;
    redirect_uri: z.ZodURL;
    response_type: z.ZodString;
    scope: z.ZodOptional<z.ZodString>;
    state: z.ZodString;
}, z.core.$loose>;
type AuthorizationRequestV1_3 = z.infer<typeof zAuthorizationRequestV1_3>;
declare const zPushedAuthorizationRequestSigned: z.ZodObject<{
    client_id: z.ZodString;
    pkceCodeVerifier: z.ZodString;
    request: z.ZodString;
}, z.core.$loose>;
type PushedAuthorizationRequestSigned = z.infer<typeof zPushedAuthorizationRequestSigned>;
declare const zPushedAuthorizationRequestUnsignedV1_0: z.ZodObject<{
    authorizationRequest: z.ZodObject<{
        authorization_details: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
            credential_configuration_id: z.ZodString;
            type: z.ZodLiteral<"openid_credential">;
        }, z.core.$strip>, z.ZodObject<{
            challenge_method: z.ZodLiteral<"mrtd+ias">;
            challenge_redirect_uri: z.ZodURL;
            idphinting: z.ZodURL;
            type: z.ZodLiteral<"it_l2+document_proof">;
        }, z.core.$strip>], "type">>>;
        client_id: z.ZodString;
        code_challenge: z.ZodString;
        code_challenge_method: z.ZodString;
        issuer_state: z.ZodOptional<z.ZodString>;
        jti: z.ZodString;
        redirect_uri: z.ZodURL;
        response_type: z.ZodString;
        scope: z.ZodOptional<z.ZodString>;
        state: z.ZodString;
        response_mode: z.ZodString;
    }, z.core.$loose>;
    client_id: z.ZodString;
    pkceCodeVerifier: z.ZodString;
}, z.core.$loose>;
type PushedAuthorizationRequestUnsignedV1_0 = z.infer<typeof zPushedAuthorizationRequestUnsignedV1_0>;
declare const zPushedAuthorizationRequestUnsignedV1_3: z.ZodObject<{
    authorizationRequest: z.ZodObject<{
        authorization_details: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
            credential_configuration_id: z.ZodString;
            type: z.ZodLiteral<"openid_credential">;
        }, z.core.$strip>, z.ZodObject<{
            challenge_method: z.ZodLiteral<"mrtd+ias">;
            challenge_redirect_uri: z.ZodURL;
            idphinting: z.ZodURL;
            type: z.ZodLiteral<"it_l2+document_proof">;
        }, z.core.$strip>], "type">>>;
        client_id: z.ZodString;
        code_challenge: z.ZodString;
        code_challenge_method: z.ZodString;
        issuer_state: z.ZodOptional<z.ZodString>;
        jti: z.ZodString;
        redirect_uri: z.ZodURL;
        response_type: z.ZodString;
        scope: z.ZodOptional<z.ZodString>;
        state: z.ZodString;
    }, z.core.$loose>;
    client_id: z.ZodString;
    pkceCodeVerifier: z.ZodString;
}, z.core.$loose>;
type PushedAuthorizationRequestUnsignedV1_3 = z.infer<typeof zPushedAuthorizationRequestUnsignedV1_3>;
/**
 * Union type for Pushed Authorization Request - can be either signed (JAR) or unsigned.
 * The variant depends on the Authorization Server's require_signed_request_object metadata.
 */
type PushedAuthorizationRequest = PushedAuthorizationRequestSigned | PushedAuthorizationRequestUnsignedV1_0 | PushedAuthorizationRequestUnsignedV1_3;
/**
 * Checks whether a pushed authorization request is represented as a signed JAR.
 *
 * @param par - Pushed authorization request to inspect.
 * @returns True when the request contains a compact `request` JWT.
 */
declare function isPushedAuthorizationRequestSigned(par: PushedAuthorizationRequest): par is PushedAuthorizationRequestSigned;
/**
 * Checks whether a pushed authorization request is represented as a plain unsigned request.
 *
 * @param par - Pushed authorization request to inspect.
 * @returns True when the request contains version-specific `authorizationRequest` data.
 */
declare function isPushedAuthorizationRequestUnsigned(par: PushedAuthorizationRequest): par is PushedAuthorizationRequestUnsignedV1_0 | PushedAuthorizationRequestUnsignedV1_3;
declare const zPushedAuthorizationResponse: z.ZodObject<{
    expires_in: z.ZodNumber;
    request_uri: z.ZodString;
}, z.core.$loose>;
type PushedAuthorizationResponse = z.infer<typeof zPushedAuthorizationResponse>;

type AuthorizationRequest$1 = AuthorizationRequestV1_0 | AuthorizationRequestV1_3;
interface BaseCreatePushedAuthorizationRequestOptions<V extends ItWalletSpecsVersion> {
    /**
     * It MUST be set to the identifier of the Credential Issuer.
     */
    audience: string;
    /**
     * Allows clients to specify their fine-grained authorization requirements using the expressiveness of JSON data structures
     */
    authorization_details?: AuthorizationRequest$1["authorization_details"];
    /**
     * Authorization Server metadata for conditional JAR signing.
     * When require_signed_request_object is true, creates a signed JWT (JAR).
     * When require_signed_request_object is false, creates an unsigned authorization request.
     * Defaults to false (unsigned) if not provided.
     *
     * @see {@link https://datatracker.ietf.org/doc/html/rfc9101#section-10.5 RFC 9101 Section 10.5}
     */
    authorizationServerMetadata?: {
        require_signed_request_object?: boolean;
    };
    /**
     * Callback context mostly for crypto related functionality
     */
    callbacks: Pick<CallbackContext, "generateRandom" | "hash" | "signJwt">;
    /**
     * MUST be set to the thumbprint of the jwk value in the cnf parameter inside the Wallet Attestation.
     */
    clientId: string;
    codeChallengeMethodsSupported: ItWalletAuthorizationServerMetadata["code_challenge_methods_supported"];
    config: IoWalletSdkConfig<V>;
    /**
     * DPoP options. Required when `require_signed_request_object` is `true`
     * (enforced at the type level via function overloads). Not used in the
     * unsigned path and can be omitted.
     */
    dpop?: RequestDpopOptions;
    /**
     * Expiration time of the JWT. If not provided 1 hour will be added to the `issuedAt`
     */
    expiresAt?: Date;
    /**
     * Creation time of the JWT. If not provided the current date will be used
     */
    issuedAt?: Date;
    /**
     * Optional issuer state from the Credential Offer authorization_code grant.
     * Serialized as issuer_state in the authorization request.
     */
    issuerState?: string;
    /**
     * jti parameter to use for PAR. If not provided a value will generated automatically
     */
    jti?: string;
    /**
     * Code verifier to use for pkce. If not provided a value will generated when pkce is supported
     */
    pkceCodeVerifier?: string;
    /**
     * Redirect uri to include in the authorization request
     */
    redirectUri: string;
    /**
     * Scope to request for the authorization request
     */
    scope?: string;
    /**
     * state parameter to use for PAR. If not provided a value will generated automatically
     */
    state?: string;
}
interface CreatePushedAuthorizationRequestOptionsV1_0 extends BaseCreatePushedAuthorizationRequestOptions<ItWalletSpecsVersion.V1_0> {
    /**
     * It MUST be one of the supported values (response_modes_supported) provided in the metadata of the Credential Issuer.
     */
    responseMode: string;
}
type CreatePushedAuthorizationRequestOptionsV1_3 = BaseCreatePushedAuthorizationRequestOptions<ItWalletSpecsVersion.V1_3>;
type CreatePushedAuthorizationRequestOptionsV1_4 = BaseCreatePushedAuthorizationRequestOptions<ItWalletSpecsVersion.V1_4>;
type CreatePushedAuthorizationRequestOptions = CreatePushedAuthorizationRequestOptionsV1_0 | CreatePushedAuthorizationRequestOptionsV1_3 | CreatePushedAuthorizationRequestOptionsV1_4;
type CreatePushedAuthorizationRequestOptionsSigned<TOptions extends CreatePushedAuthorizationRequestOptions> = {
    authorizationServerMetadata: {
        require_signed_request_object: true;
    };
    dpop: RequestDpopOptions;
} & TOptions;
type CreatePushedAuthorizationRequestOptionsUnsigned<TOptions extends CreatePushedAuthorizationRequestOptions> = {
    authorizationServerMetadata: {
        require_signed_request_object: false;
    };
} & TOptions;
/**
 * Creates a Pushed Authorization Request (PAR) for OAuth 2.0 authorization flows.
 *
 * This function conditionally creates signed JWT-Secured Authorization Requests (JAR)
 * based on the Authorization Server's `require_signed_request_object` metadata parameter
 * as defined in RFC 9101. The signing behavior enables compliance with both OAuth 2.0 PAR
 * (RFC 9126) and IT-Wallet v1.3.3 specifications.
 *
 * **Conditional JAR Signing:**
 * - When `require_signed_request_object` is `true`: Creates a signed JAR
 * - When `require_signed_request_object` is `false`: Creates an unsigned authorization request
 * - When metadata not provided: Defaults to unsigned (permissive)
 *
 * **Security Note:**
 * Disabling JAR signing (setting `require_signed_request_object: false`) should only be done
 * when the Authorization Server explicitly supports and allows unsigned requests. Signed
 * requests provide protection against request tampering and replay attacks.
 *
 * @param options - Configuration for creating the PAR
 * @param options.audience - The identifier of the Credential Issuer (used as JWT aud claim)
 * @param options.authorization_details - Fine-grained authorization requirements using JSON data structures
 * @param options.authorizationServerMetadata - Authorization Server metadata for conditional JAR signing
 * @param options.authorizationServerMetadata.require_signed_request_object -
 *   When `true`, creates a signed JAR. When `false`, creates an unsigned authorization request.
 *   Defaults to `false` if not provided (permissive).
 * @param options.callbacks - Cryptographic callback functions (generateRandom, hash, signJwt)
 * @param options.clientId - Thumbprint of the jwk value in the cnf parameter inside Wallet Attestation
 * @param options.codeChallengeMethodsSupported - Supported code challenge methods from Authorization Server
 * @param options.dpop - DPoP signer options (alg, publicJwk.kid). Required when JAR signing is enabled; omitted for unsigned requests
 * @param options.jti - Optional JWT ID for PAR (auto-generated if not provided)
 * @param options.pkceCodeVerifier - Optional PKCE code verifier (auto-generated if not provided)
 * @param options.redirectUri - Redirect URI for the authorization response
 * @param options.config - Italian Wallet specification version used to build the request shape
 * @param options.responseMode - Response mode (v1.0 only, must be supported by Credential Issuer)
 * @param options.scope - OAuth 2.0 scope to request
 * @param options.state - Optional state parameter (auto-generated if not provided)
 * @param options.expiresAt - Optional JWT expiration time (defaults to 1 hour from issuedAt)
 * @param options.issuedAt - Optional JWT issued at time (defaults to current time)
 *
 * @returns A promise resolving to either:
 *   - `PushedAuthorizationRequestSigned` when JAR signing is required (contains `request` JWT)
 *   - version-specific unsigned PAR when JAR signing is not required (contains `authorizationRequest` object)
 *
 * @throws {PushedAuthorizationRequestError} If DPoP signer is missing required properties (alg, publicJwk.kid)
 * @throws {PushedAuthorizationRequestError} If PKCE code challenge method is not supported
 * @throws {ZodError} If authorization request parameters fail validation
 *
 * @example
 * // Example 1: Create signed PAR for IT-Wallet v1.0 (explicit)
 * const config = new IoWalletSdkConfig({
 *   itWalletSpecsVersion: ItWalletSpecsVersion.V1_0,
 * });
 *
 * const signedPar = await createPushedAuthorizationRequest({
 *   audience: 'https://issuer.example.com',
 *   callbacks: { generateRandom, hash, signJwt },
 *   clientId: 'wallet_client_thumbprint',
 *   codeChallengeMethodsSupported: ['S256'],
 *   config,
 *   dpop: { signer: { alg: 'ES256', publicJwk: { kid: 'key-1' } } },
 *   redirectUri: 'https://wallet.example.com/callback',
 *   responseMode: 'form_post.jwt',
 *   scope: 'openid',
 *   authorizationServerMetadata: {
 *     require_signed_request_object: true  // Creates signed JAR
 *   }
 * });
 * // signedPar.request contains the signed JWT
 *
 * @example
 * // Example 2: Create unsigned PAR for IT-Wallet v1.3 (when Authorization Server allows it)
 * const config = new IoWalletSdkConfig({
 *   itWalletSpecsVersion: ItWalletSpecsVersion.V1_3,
 * });
 *
 * const unsignedPar = await createPushedAuthorizationRequest({
 *   audience: 'https://issuer.example.com',
 *   callbacks: { generateRandom, hash, signJwt },
 *   clientId: 'wallet_client_thumbprint',
 *   codeChallengeMethodsSupported: ['S256'],
 *   config,
 *   redirectUri: 'https://wallet.example.com/callback',
 *   scope: 'openid',
 *   authorizationServerMetadata: {
 *     require_signed_request_object: false  // Creates unsigned request — dpop not needed
 *   }
 * });
 * // unsignedPar.authorizationRequest contains the plain object
 *
 * @example
 * // Example 3: Default behavior for IT-Wallet v1.0 (no metadata - unsigned)
 * const config = new IoWalletSdkConfig({
 *   itWalletSpecsVersion: ItWalletSpecsVersion.V1_0,
 * });
 *
 * const par = await createPushedAuthorizationRequest({
 *   audience: 'https://issuer.example.com',
 *   callbacks: { generateRandom, hash, signJwt },
 *   clientId: 'wallet_client_thumbprint',
 *   codeChallengeMethodsSupported: ['S256'],
 *   config,
 *   redirectUri: 'https://wallet.example.com/callback',
 *   responseMode: 'form_post.jwt',
 *   scope: 'openid'
 *   // No authorizationServerMetadata — defaults to unsigned, dpop not needed
 * });
 * // par.authorizationRequest contains the plain object (permissive default)
 *
 * @see {@link https://datatracker.ietf.org/doc/html/rfc9126 RFC 9126 - OAuth 2.0 Pushed Authorization Requests}
 * @see {@link https://datatracker.ietf.org/doc/html/rfc9101 RFC 9101 - JWT-Secured Authorization Request (JAR)}
 * @see {@link https://datatracker.ietf.org/doc/html/rfc9101#section-10.5 RFC 9101 Section 10.5 - require_signed_request_object}
 */
declare function createPushedAuthorizationRequest(options: CreatePushedAuthorizationRequestOptionsSigned<CreatePushedAuthorizationRequestOptions>): Promise<PushedAuthorizationRequestSigned>;
declare function createPushedAuthorizationRequest(options: CreatePushedAuthorizationRequestOptionsUnsigned<CreatePushedAuthorizationRequestOptionsV1_0>): Promise<PushedAuthorizationRequestUnsignedV1_0>;
declare function createPushedAuthorizationRequest(options: CreatePushedAuthorizationRequestOptionsV1_0): Promise<PushedAuthorizationRequestSigned | PushedAuthorizationRequestUnsignedV1_0>;
declare function createPushedAuthorizationRequest(options: CreatePushedAuthorizationRequestOptionsUnsigned<CreatePushedAuthorizationRequestOptionsV1_3> | CreatePushedAuthorizationRequestOptionsUnsigned<CreatePushedAuthorizationRequestOptionsV1_4>): Promise<PushedAuthorizationRequestUnsignedV1_3>;
declare function createPushedAuthorizationRequest(options: CreatePushedAuthorizationRequestOptionsV1_3 | CreatePushedAuthorizationRequestOptionsV1_4): Promise<PushedAuthorizationRequestSigned | PushedAuthorizationRequestUnsignedV1_3>;
declare function createPushedAuthorizationRequest(options: CreatePushedAuthorizationRequestOptions): Promise<PushedAuthorizationRequest>;

/**
 * Configuration options for fetching pushed authorization response
 */
interface fetchPushedAuthorizationResponseOptions {
    /**
     * Callback functions for making HTTP requests
     * Allows for custom fetch implementations
     */
    callbacks: Pick<CallbackContext, "fetch">;
    /**
     * The client attestation Demonstration of Proof-of-Possession (DPoP) token
     * Used for OAuth-Client-Attestation-PoP header to prove possession of the client key
     */
    clientAttestationDPoP: string;
    /**
     * The pushed authorization request to send. Accepts both signed (JAR) and unsigned variants
     * as returned by `createPushedAuthorizationRequest`. The correct form body is derived
     * automatically: signed requests POST `{ client_id, request }`, unsigned requests POST
     * every field from `authorizationRequest` as flat form parameters.
     */
    pushedAuthorizationRequest: PushedAuthorizationRequest;
    /**
     * The endpoint URL where the pushed authorization request will be sent
     * This should be the authorization server's PAR endpoint
     */
    pushedAuthorizationRequestEndpoint: string;
    /**
     * The wallet attestation JWT that proves the client's identity and capabilities
     * Used for OAuth-Client-Attestation header
     */
    walletAttestation: string;
}
/**
 * Sends a pushed authorization request to the authorization server and returns the response.
 *
 * Supports both signed (JAR) and unsigned PAR variants as produced by
 * `createPushedAuthorizationRequest`. The form body is built automatically:
 * - **Signed**: posts `{ client_id, request }`.
 * - **Unsigned**: posts every field from `authorizationRequest` as flat form
 *   parameters, with object/array values (e.g. `authorization_details`)
 *   JSON-serialised.
 *
 * @param options - Configuration options for the pushed authorization request
 * @returns Promise that resolves to the parsed pushed authorization response containing request_uri and expires_in
 * @throws {UnexpectedStatusCodeError} When the server returns a non-201 status code
 * @throws {ValidationError} When the response cannot be parsed or is invalid
 */
declare function fetchPushedAuthorizationResponse(options: fetchPushedAuthorizationResponseOptions): Promise<PushedAuthorizationResponse>;

interface ParseAuthorizationRequestOptions {
    request: RequestLike$1;
}
interface ParseAuthorizationRequestResult {
    /**
     * The client attestation jwts from the authorization request headers.
     * These have not been verified yet.
     */
    clientAttestation?: {
        clientAttestationPopJwt: string;
        walletAttestationJwt: string;
    };
    /**
     * The dpop jwt from the authorization request DPoP header.
     *
     * The signer of the jwt has not been verified yet, this only happens during verification.
     */
    dpop?: {
        jwt: string;
    };
}
/**
 * Parse an authorization request by extracting DPoP and client attestation
 * information from HTTP request headers.
 *
 * **Important:** This function performs extraction and basic format validation
 * but does NOT verify cryptographic signatures. JWT signature verification
 * should be performed separately using the appropriate verification functions.
 *
 * @param options - Authorization request parsing options.
 * @returns Parsed authorization request result containing:
 * - `dpop` - DPoP information if present (jwt)
 * - `clientAttestation` - Client attestation JWTs if present
 *
 * @throws {Oauth2Error} When DPoP JWT format is invalid
 * @throws {Oauth2Error} When client attestation headers are incomplete
 */
declare function parseAuthorizationRequest(options: ParseAuthorizationRequestOptions): ParseAuthorizationRequestResult;

type AuthorizationRequest = AuthorizationRequestV1_0 | AuthorizationRequestV1_3;
interface ParsePushedAuthorizationRequestOptions {
    authorizationRequest: unknown;
    callbacks: Pick<CallbackContext, "fetch">;
    config: IoWalletSdkConfig;
    request: RequestLike$1;
}
interface ParsePushedAuthorizationRequestResult extends ParseAuthorizationRequestResult {
    authorizationRequest: AuthorizationRequest;
    /**
     * The JWT-secured request object, if the request was pushed as a JAR.
     * May be undefined if the request object is not a JAR.
     */
    authorizationRequestJwt?: string;
}
/**
 * Parses and validates a pushed authorization request (PAR).
 *
 * Handles both standard authorization requests and JWT-secured Authorization Requests (JAR).
 * When a JAR is provided, it validates the JWT structure, decodes it, and extracts the
 * authorization request from the payload. Also extracts client attestation and DPoP proofs
 * from the HTTP request headers.
 *
 * @param options - Configuration for parsing the pushed authorization request
 * @param options.authorizationRequest - The authorization request data to parse (can be standard or JAR format)
 * @param options.callbacks - Callbacks for external operations (requires `fetch` for JAR validation)
 * @param options.request - The HTTP request object containing headers for client attestation and DPoP
 * @returns A promise resolving to the parsed authorization request with extracted metadata
 * @throws {Oauth2Error} When the authorization request is invalid or cannot be parsed
 */
declare function parsePushedAuthorizationRequest(options: ParsePushedAuthorizationRequestOptions): Promise<ParsePushedAuthorizationRequestResult>;

interface VerifyAuthorizationRequestDPoP {
    /**
     * Allowed dpop signing alg values. If not provided
     * any alg values are allowed and it's up to the `verifyJwtCallback`
     * to handle the alg.
     */
    allowedSigningAlgs?: string[];
    /**
     * The dpop jwt from the pushed authorization request.
     * If dpop is required, `jwt` MUST be provided
     */
    jwt?: string;
    /**
     * Whether dpop is required.
     */
    required?: boolean;
}
interface VerifyAuthorizationRequestResult {
    /**
     * The verified client attestation if any were provided.
     */
    clientAttestation?: {
        clientAttestation: VerifiedWalletAttestationJwt;
        clientAttestationPop: VerifiedClientAttestationPopJwt;
    };
    dpop?: {
        /**
         * The JWK will be returned if a DPoP proof was provided in the header.
         */
        jwk?: Jwk;
        /**
         * base64url encoding of the JWK SHA-256 Thumbprint (according to [RFC7638])
         * of the DPoP public key (in JWK format).
         *
         * This will always be returned if dpop is used for the PAR endpoint
         */
        jwkThumbprint: string;
    };
}
interface VerifyAuthorizationRequestOptions {
    authorizationRequest: {
        client_id?: string;
    };
    authorizationServerMetadata: ItWalletAuthorizationServerMetadata;
    callbacks: Pick<CallbackContext, "hash" | "verifyJwt">;
    clientAttestation: ClientAttestationOptions;
    config: IoWalletSdkConfig;
    dpop?: VerifyAuthorizationRequestDPoP;
    /**
     * The current time to use when verifying the JWTs.
     * If not provided current time will be used.
     *
     * @default new Date()
     */
    now?: Date;
    request: RequestLike$1;
}
/**
 * Verifies an authorization request by validating DPoP and client attestation credentials.
 *
 * This function performs cryptographic verification of DPoP proofs and client attestation
 * JWTs extracted from authorization request headers. It validates signatures, checks
 * expiration times, and optionally ensures that DPoP and client attestation use the same key.
 *
 * **Important:** This function performs verification only. Use `parseAuthorizationRequest`
 * first to extract the necessary JWTs from request headers.
 *
 * @param options - The verification options
 * @param options.authorizationRequest - The authorization request parameters containing client_id
 * @param options.authorizationServerMetadata - Authorization server metadata including issuer
 * @param options.callbacks - Cryptographic callback functions for hash and JWT verification
 * @param options.dpop - Optional DPoP verification configuration
 * @param options.clientAttestation - Client attestation verification configuration
 * @param options.request - The HTTP request object containing URL and headers
 * @param options.now - Optional date for time-based validation (defaults to current time)
 *
 * @returns A promise resolving to verification results containing:
 * - `dpop` - Verified DPoP information including JWK and thumbprint (if DPoP was provided)
 * - `clientAttestation` - Verified client attestation JWTs (if client attestation was provided)
 *
 * @throws {Oauth2Error} When DPoP is required but missing
 * @throws {Oauth2Error} When client attestation is required but missing
 * @throws {Oauth2Error} When client_id doesn't match between request and client attestation
 * @throws {Oauth2Error} When DPoP and client attestation keys don't match (if ensureConfirmationKeyMatchesDpopKey is true)
 * @throws {Oauth2Error} When JWT signature verification fails
 * @throws {Oauth2Error} When JWT is expired or has invalid claims
 *
 * @example
 * ```typescript
 * const result = await verifyAuthorizationRequest({
 *   authorizationRequest: { client_id: 'client-123' },
 *   authorizationServerMetadata: { issuer: 'https://auth.example.com' },
 *   callbacks: { hash: hashCallback, verifyJwt: verifyJwtCallback },
 *   dpop: {
 *     jwt: dpopJwtFromHeaders,
 *     required: true,
 *     allowedSigningAlgs: ['ES256']
 *   },
 *   clientAttestation: {
 *     walletAttestationJwt: clientAttJwtFromHeaders,
 *     clientAttestationPopJwt: clientAttPopJwtFromHeaders,
 *     required: true,
 *     ensureConfirmationKeyMatchesDpopKey: true
 *   },
 *   request: httpRequest
 * });
 *
 * console.log(result.dpop?.jwkThumbprint);
 * console.log(result.clientAttestation?.clientAttestation.payload.sub);
 * ```
 */
declare function verifyAuthorizationRequest(options: VerifyAuthorizationRequestOptions): Promise<VerifyAuthorizationRequestResult>;

declare const zTrustChain: z.ZodTuple<[z.ZodString], z.ZodString>;
type TrustChain = z.infer<typeof zTrustChain>;
declare const zCertificateChain: z.ZodArray<z.ZodString>;
type CertificateChain = z.infer<typeof zCertificateChain>;
declare const zAlgValueNotNone: z.ZodString;
interface RequestLike {
    headers: FetchHeaders;
    method: HttpMethod;
    url: string;
}

declare const MAX_JTI_LENGTH = 256;
interface JwtSignerDid {
    alg: string;
    didUrl: string;
    /**
     * The key id that should be used for signing. You need to make sure the kid actually matches
     * with the key associated with the didUrl.
     */
    kid?: string;
    method: "did";
}
interface JwtSignerJwk {
    alg: string;
    /**
     * The key id that should be used for signing. You need to make sure the kid actually matches
     * with the key associated with the jwk.
     *
     * If not provided the kid can also be extracted from the `publicJwk`. Providing it here means the `kid` won't
     * be included in the JWT header.
     */
    kid?: string;
    method: "jwk";
    publicJwk: Jwk;
}
interface JwtSignerX5c {
    alg: string;
    /**
     * The key id that should be used for signing. You need to make sure the kid actually matches
     * with the key associated with the leaf certificate.
     */
    kid?: string;
    method: "x5c";
    trustChain?: TrustChain;
    x5c: string[];
}
interface JwtSignerFederation {
    alg: string;
    /**
     * The key id that should be used for signing. You need to make sure the kid actually matches
     * with a key present in the federation.
     */
    kid: string;
    method: "federation";
    trustChain?: TrustChain;
}
interface JwtSignerCustom {
    alg: string;
    /**
     * The key id that should be used for signing.
     */
    kid?: string;
    method: "custom";
}
type JwtSigner = JwtSignerCustom | JwtSignerDid | JwtSignerFederation | JwtSignerJwk | JwtSignerX5c;
type JwtSignerWithJwk = {
    publicJwk: Jwk;
} & JwtSigner;
type JweEncryptor = {
    /**
     * base64-url encoded apu
     */
    apu?: string;
    /**
     * base64-url encoded apv
     */
    apv?: string;
    enc: string;
} & JwtSignerJwk;
declare const zCompactJwt: z.ZodString;
declare const zJwtConfirmationPayload: z.ZodObject<{
    jkt: z.ZodOptional<z.ZodString>;
    jwk: z.ZodOptional<z.ZodObject<{
        alg: z.ZodOptional<z.ZodString>;
        crv: z.ZodOptional<z.ZodString>;
        d: z.ZodOptional<z.ZodString>;
        dp: z.ZodOptional<z.ZodString>;
        dq: z.ZodOptional<z.ZodString>;
        e: z.ZodOptional<z.ZodString>;
        ext: z.ZodOptional<z.ZodBoolean>;
        k: z.ZodOptional<z.ZodString>;
        key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
        kid: z.ZodOptional<z.ZodString>;
        kty: z.ZodString;
        n: z.ZodOptional<z.ZodString>;
        oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
            d: z.ZodOptional<z.ZodString>;
            r: z.ZodOptional<z.ZodString>;
            t: z.ZodOptional<z.ZodString>;
        }, z.core.$loose>>>;
        p: z.ZodOptional<z.ZodString>;
        q: z.ZodOptional<z.ZodString>;
        qi: z.ZodOptional<z.ZodString>;
        use: z.ZodOptional<z.ZodString>;
        x: z.ZodOptional<z.ZodString>;
        x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
        x5t: z.ZodOptional<z.ZodString>;
        "x5t#S256": z.ZodOptional<z.ZodString>;
        x5u: z.ZodOptional<z.ZodString>;
        y: z.ZodOptional<z.ZodString>;
    }, z.core.$loose>>;
}, z.core.$loose>;
declare const zJwtPayload: z.ZodObject<{
    aud: z.ZodOptional<z.ZodString>;
    cnf: z.ZodOptional<z.ZodObject<{
        jkt: z.ZodOptional<z.ZodString>;
        jwk: z.ZodOptional<z.ZodObject<{
            alg: z.ZodOptional<z.ZodString>;
            crv: z.ZodOptional<z.ZodString>;
            d: z.ZodOptional<z.ZodString>;
            dp: z.ZodOptional<z.ZodString>;
            dq: z.ZodOptional<z.ZodString>;
            e: z.ZodOptional<z.ZodString>;
            ext: z.ZodOptional<z.ZodBoolean>;
            k: z.ZodOptional<z.ZodString>;
            key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
            kid: z.ZodOptional<z.ZodString>;
            kty: z.ZodString;
            n: z.ZodOptional<z.ZodString>;
            oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
                d: z.ZodOptional<z.ZodString>;
                r: z.ZodOptional<z.ZodString>;
                t: z.ZodOptional<z.ZodString>;
            }, z.core.$loose>>>;
            p: z.ZodOptional<z.ZodString>;
            q: z.ZodOptional<z.ZodString>;
            qi: z.ZodOptional<z.ZodString>;
            use: z.ZodOptional<z.ZodString>;
            x: z.ZodOptional<z.ZodString>;
            x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
            x5t: z.ZodOptional<z.ZodString>;
            "x5t#S256": z.ZodOptional<z.ZodString>;
            x5u: z.ZodOptional<z.ZodString>;
            y: z.ZodOptional<z.ZodString>;
        }, z.core.$loose>>;
    }, z.core.$loose>>;
    exp: z.ZodOptional<z.ZodNumber>;
    iat: z.ZodOptional<z.ZodNumber>;
    iss: z.ZodOptional<z.ZodString>;
    jti: z.ZodOptional<z.ZodString>;
    nbf: z.ZodOptional<z.ZodNumber>;
    nonce: z.ZodOptional<z.ZodString>;
    status: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
    trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
}, z.core.$loose>;
type JwtPayload = z.infer<typeof zJwtPayload>;
declare const zJwtHeader: z.ZodObject<{
    alg: z.ZodString;
    jwk: z.ZodOptional<z.ZodObject<{
        alg: z.ZodOptional<z.ZodString>;
        crv: z.ZodOptional<z.ZodString>;
        d: z.ZodOptional<z.ZodString>;
        dp: z.ZodOptional<z.ZodString>;
        dq: z.ZodOptional<z.ZodString>;
        e: z.ZodOptional<z.ZodString>;
        ext: z.ZodOptional<z.ZodBoolean>;
        k: z.ZodOptional<z.ZodString>;
        key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
        kid: z.ZodOptional<z.ZodString>;
        kty: z.ZodString;
        n: z.ZodOptional<z.ZodString>;
        oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
            d: z.ZodOptional<z.ZodString>;
            r: z.ZodOptional<z.ZodString>;
            t: z.ZodOptional<z.ZodString>;
        }, z.core.$loose>>>;
        p: z.ZodOptional<z.ZodString>;
        q: z.ZodOptional<z.ZodString>;
        qi: z.ZodOptional<z.ZodString>;
        use: z.ZodOptional<z.ZodString>;
        x: z.ZodOptional<z.ZodString>;
        x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
        x5t: z.ZodOptional<z.ZodString>;
        "x5t#S256": z.ZodOptional<z.ZodString>;
        x5u: z.ZodOptional<z.ZodString>;
        y: z.ZodOptional<z.ZodString>;
    }, z.core.$loose>>;
    kid: z.ZodOptional<z.ZodString>;
    trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
    typ: z.ZodOptional<z.ZodString>;
    x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
}, z.core.$loose>;
type JwtHeader = z.infer<typeof zJwtHeader>;

interface DecodeJwtOptions<HeaderSchema extends BaseSchema | undefined, PayloadSchema extends BaseSchema | undefined> {
    /**
     * Optional prefix for error messages thrown during decoding, to provide more context on where the error occurred
     */
    errorMessagePrefix?: string;
    /**
     * Schema to use for validating the header. If not provided the
     * default `zJwtHeader` schema will be used
     */
    headerSchema?: HeaderSchema;
    /**
     * The compact encoded jwt
     */
    jwt: string;
    /**
     * Schema to use for validating the payload. If not provided the
     * default `zJwtPayload` schema will be used
     */
    payloadSchema?: PayloadSchema;
}
interface DecodeJwtResult<HeaderSchema extends BaseSchema | undefined = undefined, PayloadSchema extends BaseSchema | undefined = undefined> {
    header: InferSchemaOrDefaultOutput<HeaderSchema, typeof zJwtHeader>;
    payload: InferSchemaOrDefaultOutput<PayloadSchema, typeof zJwtPayload>;
    signature: string;
}
/**
 * Decodes a compact JWT and validates its header and payload with Zod schemas.
 *
 * This helper does not verify the JWT signature.
 *
 * @param options - Decode options.
 * @param options.errorMessagePrefix - Optional context prefix for thrown parse/validation errors.
 * @param options.headerSchema - Optional schema for the JWT header; defaults to `zJwtHeader`.
 * @param options.jwt - Compact JWT to decode.
 * @param options.payloadSchema - Optional schema for the JWT payload; defaults to `zJwtPayload`.
 * @returns Decoded and schema-validated JWT header, payload, and signature segment.
 * @throws {Oauth2JwtParseError} If the JWT shape or base64url JSON segments are invalid.
 * @throws {ValidationError} If header or payload schema validation fails.
 */
declare function decodeJwt<HeaderSchema extends BaseSchema | undefined = undefined, PayloadSchema extends BaseSchema | undefined = undefined>(options: DecodeJwtOptions<HeaderSchema, PayloadSchema>): DecodeJwtResult<HeaderSchema, PayloadSchema>;
type IsSchemaProvided<T> = T extends undefined ? false : true;
type InferSchemaOrDefaultOutput<ProvidedSchema extends BaseSchema | undefined, DefaultSchema extends BaseSchema> = IsSchemaProvided<ProvidedSchema> extends true ? ProvidedSchema extends BaseSchema ? z.infer<ProvidedSchema> : never : z.infer<DefaultSchema>;

declare const zJarAuthorizationRequest: z.ZodObject<{
    client_id: z.ZodOptional<z.ZodString>;
    request: z.ZodOptional<z.ZodString>;
    request_uri: z.ZodOptional<z.ZodURL>;
}, z.core.$loose>;
type JarAuthorizationRequest = z.infer<typeof zJarAuthorizationRequest>;
declare const zJarRequestObjectPayload: z.ZodObject<{
    client_id: z.ZodString;
    aud: z.ZodOptional<z.ZodString>;
    cnf: z.ZodOptional<z.ZodObject<{
        jkt: z.ZodOptional<z.ZodString>;
        jwk: z.ZodOptional<z.ZodObject<{
            alg: z.ZodOptional<z.ZodString>;
            crv: z.ZodOptional<z.ZodString>;
            d: z.ZodOptional<z.ZodString>;
            dp: z.ZodOptional<z.ZodString>;
            dq: z.ZodOptional<z.ZodString>;
            e: z.ZodOptional<z.ZodString>;
            ext: z.ZodOptional<z.ZodBoolean>;
            k: z.ZodOptional<z.ZodString>;
            key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
            kid: z.ZodOptional<z.ZodString>;
            kty: z.ZodString;
            n: z.ZodOptional<z.ZodString>;
            oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
                d: z.ZodOptional<z.ZodString>;
                r: z.ZodOptional<z.ZodString>;
                t: z.ZodOptional<z.ZodString>;
            }, z.core.$loose>>>;
            p: z.ZodOptional<z.ZodString>;
            q: z.ZodOptional<z.ZodString>;
            qi: z.ZodOptional<z.ZodString>;
            use: z.ZodOptional<z.ZodString>;
            x: z.ZodOptional<z.ZodString>;
            x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
            x5t: z.ZodOptional<z.ZodString>;
            "x5t#S256": z.ZodOptional<z.ZodString>;
            x5u: z.ZodOptional<z.ZodString>;
            y: z.ZodOptional<z.ZodString>;
        }, z.core.$loose>>;
    }, z.core.$loose>>;
    exp: z.ZodOptional<z.ZodNumber>;
    iat: z.ZodOptional<z.ZodNumber>;
    iss: z.ZodOptional<z.ZodString>;
    jti: z.ZodOptional<z.ZodString>;
    nbf: z.ZodOptional<z.ZodNumber>;
    nonce: z.ZodOptional<z.ZodString>;
    status: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
    trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
}, z.core.$loose>;
type JarRequestObjectPayload = z.infer<typeof zJarRequestObjectPayload>;
declare const zSignedAuthorizationRequestJwtHeaderTyp: z.ZodLiteral<"oauth-authz-req+jwt">;
declare const zJarRequestObjectHeader: z.ZodObject<{
    typ: z.ZodLiteral<"oauth-authz-req+jwt">;
    alg: z.ZodString;
    jwk: z.ZodOptional<z.ZodObject<{
        alg: z.ZodOptional<z.ZodString>;
        crv: z.ZodOptional<z.ZodString>;
        d: z.ZodOptional<z.ZodString>;
        dp: z.ZodOptional<z.ZodString>;
        dq: z.ZodOptional<z.ZodString>;
        e: z.ZodOptional<z.ZodString>;
        ext: z.ZodOptional<z.ZodBoolean>;
        k: z.ZodOptional<z.ZodString>;
        key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
        kid: z.ZodOptional<z.ZodString>;
        kty: z.ZodString;
        n: z.ZodOptional<z.ZodString>;
        oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
            d: z.ZodOptional<z.ZodString>;
            r: z.ZodOptional<z.ZodString>;
            t: z.ZodOptional<z.ZodString>;
        }, z.core.$loose>>>;
        p: z.ZodOptional<z.ZodString>;
        q: z.ZodOptional<z.ZodString>;
        qi: z.ZodOptional<z.ZodString>;
        use: z.ZodOptional<z.ZodString>;
        x: z.ZodOptional<z.ZodString>;
        x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
        x5t: z.ZodOptional<z.ZodString>;
        "x5t#S256": z.ZodOptional<z.ZodString>;
        x5u: z.ZodOptional<z.ZodString>;
        y: z.ZodOptional<z.ZodString>;
    }, z.core.$loose>>;
    kid: z.ZodOptional<z.ZodString>;
    trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
    x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
}, z.core.$loose>;
type JarRequestObjectHeader = z.infer<typeof zJarRequestObjectHeader>;
declare const signedAuthorizationRequestJwtHeaderTyp: "oauth-authz-req+jwt";
declare const jwtAuthorizationRequestJwtHeaderTyp: "jwt";

interface VerifyJarRequestOptions {
    authorizationRequestJwt: string;
    callbacks: Pick<CallbackContext, "verifyJwt">;
    jarRequestParams: {
        client_id?: string;
    };
    jwtSigner: JwtSigner$1;
    now?: Date;
}
interface VerifiedJarRequest {
    authorizationRequestPayload: JarRequestObjectPayload;
    jwt: {
        payload: JarRequestObjectPayload;
    } & Omit<ReturnType<typeof decodeJwt>, "payload">;
    signer: JwtSignerWithJwk$1;
}
/**
 * Verifies a JAR (JWT Secured Authorization Request) request by validating and verifying signatures.
 *
 * @param options - The input parameters
 * @param options.jarRequestParams - The JAR authorization request parameters
 * @param options.callbacks - Context containing the relevant Jose crypto operations
 * @returns The verified authorization request parameters and metadata
 */
declare function verifyJarRequest(options: VerifyJarRequestOptions): Promise<VerifiedJarRequest>;

interface VerifyPushedAuthorizationRequestReturn extends VerifyAuthorizationRequestResult {
    /**
     * The verified JAR request, if `authorizationRequestJwt` was provided
     */
    jar?: VerifiedJarRequest;
}
interface VerifyPushedAuthorizationRequestOptions extends Omit<VerifyAuthorizationRequestOptions, "authorizationServerMetadata"> {
    /**
     * The authorization request JWT to verify. If this value was returned from `parsePushedAuthorizationRequest`
     * you MUST provide this value to ensure the JWT is verified.
     */
    authorizationRequestJwt?: {
        jwt: string;
        signer: JwtSigner$1;
    };
    /**
     * Authorization Server metadata for enforcing JAR signing policy.
     * Includes standard Authorization Server metadata plus require_signed_request_object.
     * When require_signed_request_object is true, the server will reject unsigned requests.
     * Defaults to false (permissive) if not provided.
     *
     * @see {@link https://datatracker.ietf.org/doc/html/rfc9101#section-10.5 RFC 9101 Section 10.5}
     */
    authorizationServerMetadata: {
        require_signed_request_object?: boolean;
    } & VerifyAuthorizationRequestOptions["authorizationServerMetadata"];
}
/**
 * Verifies a pushed authorization request (PAR) including JAR, DPoP, and client attestation.
 *
 * This function extends `verifyAuthorizationRequest` by adding support for JWT-secured
 * Authorization Requests (JAR). It performs comprehensive verification of all security
 * mechanisms used in pushed authorization requests according to RFC 9126 (PAR) and
 * RFC 9101 (JAR).
 *
 * The verification process includes:
 * 1. JAR signing policy enforcement (per RFC 9101 Section 10.5) - validates require_signed_request_object
 * 2. JAR request object verification (if provided) - validates JWT signature and claims
 * 3. RFC 9101 §4 claim validation - validates iss, aud, exp, iat claims
 * 4. IT-Wallet specific validations - iat age limits and key binding with wallet attestation
 * 5. DPoP proof verification (if provided) - validates proof of possession
 * 6. Client attestation verification - validates client identity
 *
 * **JAR Signing Policy (RFC 9101):**
 * When `authorizationServerMetadata.require_signed_request_object` is true:
 * - Rejects requests without signed JAR (downgrade attack protection)
 * - Rejects JAR with algorithm "none" (security requirement)
 * When false or omitted (default): accepts both signed and unsigned requests
 *
 * **Important:** Use `parsePushedAuthorizationRequest` first to extract the necessary
 * JWTs from request headers and body.
 *
 * @param options - The verification options
 * @param options.authorizationRequest - The authorization request parameters containing client_id
 * @param options.authorizationServerMetadata - Authorization server metadata
 * @param options.callbacks - Cryptographic callback functions for hash and JWT verification
 * @param options.authorizationRequestJwt - Optional JAR JWT and signer information
 * @param options.dpop - Optional DPoP verification configuration
 * @param options.clientAttestation - Optional client attestation verification configuration
 * @param options.request - The HTTP request object containing URL and headers
 * @param options.now - Optional date for time-based validation (defaults to current time)
 *
 * @returns A promise resolving to verification results containing:
 * - `jar` - Verified JAR request including decoded payload and signer (if JAR was provided)
 * - `dpop` - Verified DPoP information including JWK and thumbprint (if DPoP was provided)
 * - `clientAttestation` - Verified client attestation JWTs (if client attestation was provided)
 *
 * @throws {PushedAuthorizationRequestError} When require_signed_request_object is true but request is unsigned
 * @throws {PushedAuthorizationRequestError} When require_signed_request_object is true but JAR uses alg="none"
 * @throws {PushedAuthorizationRequestError} When iss claim doesn't match client_id (RFC 9101 §4)
 * @throws {PushedAuthorizationRequestError} When aud claim doesn't match authorization server issuer (RFC 9101 §4)
 * @throws {PushedAuthorizationRequestError} When exp claim is missing or expired (RFC 9101 §4)
 * @throws {PushedAuthorizationRequestError} When iat claim is missing, too old (>5 min), or in future (>60s)
 * @throws {PushedAuthorizationRequestError} When kid doesn't match between JAR and wallet attestation cnf.jwk
 * @throws {PushedAuthorizationRequestError} When cnf.jwk is missing from wallet attestation
 * @throws {Oauth2Error} When JAR JWT verification fails
 * @throws {Oauth2Error} When JAR client_id doesn't match request client_id
 * @throws {Oauth2Error} When JAR request object is encrypted (not supported)
 * @throws {Oauth2Error} When DPoP is required but missing
 * @throws {Oauth2Error} When client attestation is required but missing
 * @throws {Oauth2Error} When client_id doesn't match between request and client attestation
 * @throws {Oauth2Error} When DPoP and client attestation keys don't match (if ensureConfirmationKeyMatchesDpopKey is true)
 * @throws {Oauth2Error} When any JWT signature verification fails
 * @throws {Oauth2Error} When any JWT is expired or has invalid claims
 *
 * @example
 * ```typescript
 * // Example 1: Enforce signed JAR (strict mode)
 * const result = await verifyPushedAuthorizationRequest({
 *   authorizationRequest: parsed.authorizationRequest,
 *   authorizationServerMetadata: {
 *     issuer: 'https://auth.example.com',
 *     require_signed_request_object: true  // Reject unsigned requests
 *   },
 *   callbacks: { hash: hashCallback, verifyJwt: verifyJwtCallback },
 *   authorizationRequestJwt: {
 *     jwt: parsed.authorizationRequestJwt,
 *     signer: clientSignerFromFederation
 *   },
 *   request: httpRequest
 * });
 *
 * // Example 2: Accept both signed and unsigned (permissive mode)
 * const result = await verifyPushedAuthorizationRequest({
 *   authorizationRequest: parsed.authorizationRequest,
 *   authorizationServerMetadata: {
 *     issuer: 'https://auth.example.com',
 *     require_signed_request_object: false  // Accept unsigned requests
 *   },
 *   callbacks: { hash: hashCallback, verifyJwt: verifyJwtCallback },
 *   authorizationRequestJwt: parsed.authorizationRequestJwt ? {
 *     jwt: parsed.authorizationRequestJwt,
 *     signer: clientSignerFromFederation
 *   } : undefined,
 *   request: httpRequest
 * });
 * ```
 *
 * @see {@link https://datatracker.ietf.org/doc/html/rfc9101#section-10.5 RFC 9101 Section 10.5 - require_signed_request_object}
 */
declare function verifyPushedAuthorizationRequest(options: VerifyPushedAuthorizationRequestOptions): Promise<VerifyPushedAuthorizationRequestReturn>;

/**
 * Supported OAuth 2.0 client authentication methods.
 */
declare const SupportedClientAuthenticationMethod: {
    readonly ClientSecretBasic: "client_secret_basic";
    readonly ClientSecretPost: "client_secret_post";
    readonly None: "none";
    readonly WalletAttestationJwt: "attest_jwt_client_auth";
};
/**
 * Union type of supported client authentication methods.
 */
type SupportedClientAuthenticationMethod = (typeof SupportedClientAuthenticationMethod)[keyof typeof SupportedClientAuthenticationMethod];
/**
 * Options for checking client attestation support.
 */
interface IsClientAttestationSupportedOptions {
    /** Authorization server metadata containing supported authentication methods. */
    authorizationServerMetadata: ItWalletAuthorizationServerMetadata;
}
/**
 * Checks whether the authorization server supports client attestation authentication.
 *
 * @param options - Configuration including authorization server metadata
 * @returns Object with `supported` boolean indicating if client attestation is available
 */
declare function isClientAttestationSupported(options: IsClientAttestationSupportedOptions): {
    supported: boolean;
};
/**
 * Options for client authentication
 */
interface ClientAuthenticationCallbackOptions {
    /**
     * Metadata of the authorization server
     */
    authorizationServerMetadata: ItWalletAuthorizationServerMetadata;
    /**
     * The body as a JSON object. If content type `x-www-form-urlencoded`
     * is used, it will be encoded after this call.
     *
     * You can modify this object
     */
    body: Record<string, unknown>;
    contentType: ContentType;
    /**
     * Headers for the request. You can modify this object
     */
    headers: FetchHeaders;
    /**
     * http method that will be used
     */
    method: HttpMethod;
    /**
     * URL to which the request will be made
     */
    url: string;
}
/**
 * Callback method to determine the client authentication for a request.
 */
type ClientAuthenticationCallback = (options: ClientAuthenticationCallbackOptions) => Promise<void> | void;
/**
 * Creates a client authentication callback that leaves the request unchanged.
 *
 * @returns Client authentication callback for anonymous requests.
 */
declare function clientAuthenticationAnonymous(): ClientAuthenticationCallback;
interface ClientAuthenticationWalletAttestationJwtOptions<V extends ItWalletSpecsVersion = ItWalletSpecsVersion> {
    callbacks: Pick<CallbackContext, "generateRandom" | "signJwt">;
    config: IoWalletSdkConfig<V>;
    walletAttestationJwt: string;
}
/**
 * Client authentication using wallet attestation JWT.
 * This method adds the wallet attestation JWT and a proof-of-possession JWT to the request headers.
 *
 * @param options - Wallet attestation client authentication options.
 * @param options.callbacks - Random generation and signing callbacks for the PoP JWT.
 * @param options.config - IT-Wallet specification version used to create the PoP JWT.
 * @param options.walletAttestationJwt - Wallet attestation JWT to attach to outgoing requests.
 * @returns Client authentication callback that mutates request headers with attestation values.
 * @throws {Oauth2Error} If the PoP JWT cannot be created.
 */
declare function clientAuthenticationWalletAttestationJwt<V extends ItWalletSpecsVersion = ItWalletSpecsVersion>(options: ClientAuthenticationWalletAttestationJwtOptions<V>): ClientAuthenticationCallback;

/**
 * JWT Header schema for IT-Wallet v1.0 Wallet Attestation
 *
 * Version 1.0 specifics:
 * - trust_chain is REQUIRED
 * - x5c is NOT supported
 */
declare const zWalletAttestationJwtHeaderV1_0: z$1.ZodObject<{
    trust_chain: z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>;
    typ: z$1.ZodLiteral<"oauth-client-attestation+jwt">;
    alg: z$1.ZodString;
    jwk: z$1.ZodOptional<z$1.ZodObject<{
        alg: z$1.ZodOptional<z$1.ZodString>;
        crv: z$1.ZodOptional<z$1.ZodString>;
        d: z$1.ZodOptional<z$1.ZodString>;
        dp: z$1.ZodOptional<z$1.ZodString>;
        dq: z$1.ZodOptional<z$1.ZodString>;
        e: z$1.ZodOptional<z$1.ZodString>;
        ext: z$1.ZodOptional<z$1.ZodBoolean>;
        k: z$1.ZodOptional<z$1.ZodString>;
        key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
        kid: z$1.ZodOptional<z$1.ZodString>;
        kty: z$1.ZodString;
        n: z$1.ZodOptional<z$1.ZodString>;
        oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
            d: z$1.ZodOptional<z$1.ZodString>;
            r: z$1.ZodOptional<z$1.ZodString>;
            t: z$1.ZodOptional<z$1.ZodString>;
        }, z$1.core.$loose>>>;
        p: z$1.ZodOptional<z$1.ZodString>;
        q: z$1.ZodOptional<z$1.ZodString>;
        qi: z$1.ZodOptional<z$1.ZodString>;
        use: z$1.ZodOptional<z$1.ZodString>;
        x: z$1.ZodOptional<z$1.ZodString>;
        x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
        x5t: z$1.ZodOptional<z$1.ZodString>;
        "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
        x5u: z$1.ZodOptional<z$1.ZodString>;
        y: z$1.ZodOptional<z$1.ZodString>;
    }, z$1.core.$loose>>;
    kid: z$1.ZodOptional<z$1.ZodString>;
    x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
}, z$1.core.$loose>;
/**
 * JWT Payload schema for IT-Wallet v1.0 Wallet Attestation
 *
 * Version 1.0 specifics:
 * - Standard claims only
 * - No nbf or status support
 */
declare const zWalletAttestationJwtPayloadV1_0: z$1.ZodObject<{
    aal: z$1.ZodString;
    cnf: z$1.ZodObject<{
        jwk: z$1.ZodObject<{
            alg: z$1.ZodOptional<z$1.ZodString>;
            crv: z$1.ZodOptional<z$1.ZodString>;
            d: z$1.ZodOptional<z$1.ZodString>;
            dp: z$1.ZodOptional<z$1.ZodString>;
            dq: z$1.ZodOptional<z$1.ZodString>;
            e: z$1.ZodOptional<z$1.ZodString>;
            ext: z$1.ZodOptional<z$1.ZodBoolean>;
            k: z$1.ZodOptional<z$1.ZodString>;
            key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
            kid: z$1.ZodOptional<z$1.ZodString>;
            kty: z$1.ZodString;
            n: z$1.ZodOptional<z$1.ZodString>;
            oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
                d: z$1.ZodOptional<z$1.ZodString>;
                r: z$1.ZodOptional<z$1.ZodString>;
                t: z$1.ZodOptional<z$1.ZodString>;
            }, z$1.core.$loose>>>;
            p: z$1.ZodOptional<z$1.ZodString>;
            q: z$1.ZodOptional<z$1.ZodString>;
            qi: z$1.ZodOptional<z$1.ZodString>;
            use: z$1.ZodOptional<z$1.ZodString>;
            x: z$1.ZodOptional<z$1.ZodString>;
            x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
            x5t: z$1.ZodOptional<z$1.ZodString>;
            "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
            x5u: z$1.ZodOptional<z$1.ZodString>;
            y: z$1.ZodOptional<z$1.ZodString>;
        }, z$1.core.$loose>;
    }, z$1.core.$strip>;
    exp: z$1.ZodNumber;
    iat: z$1.ZodNumber;
    iss: z$1.ZodString;
    sub: z$1.ZodString;
    wallet_link: z$1.ZodOptional<z$1.ZodURL>;
    wallet_name: z$1.ZodOptional<z$1.ZodString>;
    aud: z$1.ZodOptional<z$1.ZodString>;
    jti: z$1.ZodOptional<z$1.ZodString>;
    nbf: z$1.ZodOptional<z$1.ZodNumber>;
    nonce: z$1.ZodOptional<z$1.ZodString>;
    status: z$1.ZodOptional<z$1.ZodRecord<z$1.ZodString, z$1.ZodAny>>;
    trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
}, z$1.core.$loose>;
/**
 * Wallet Attestation JWT type for v1.0
 * The JWT is returned as a compact string
 */
type WalletAttestationJwtV1_0 = string;
/**
 * Zod schema for wallet attestation JWT validation (v1.0)
 * Validates that the result is a non-empty string
 */
declare const zWalletAttestationJwtV1_0: z$1.ZodString;

/**
 * Options for creating a wallet attestation with v1.0
 * Uses only trust_chain (federation method)
 */
interface WalletAttestationOptionsV1_0 extends BaseWalletAttestationOptions {
    /**
     * It expresses the strength of the authentication mechanism backing the Wallet instance when interacting with a Relying Party.
     */
    authenticatorAssuranceLevel: string;
    signer: {
        alg: string;
        kid: string;
        method: "federation";
        trustChain: [string, ...string[]];
    };
}
/**
 * Create a Wallet Attestation JWT for IT-Wallet v1.0
 *
 * Version 1.0 specifics:
 * - Uses only `trust_chain` in header (federation method)
 *
 * @param options - Wallet attestation options for v1.0
 * @returns Signed wallet attestation JWT string
 * @throws {ValidationError} When validation of the JWT structure fails
 * @throws {ClientAttestationError} For other unexpected errors during creation
 * @internal This function is called by the WalletProvider router
 */
declare const createWalletAttestationJwt$2: (options: WalletAttestationOptionsV1_0) => Promise<WalletAttestationJwtV1_0>;

/**
 * JWT Header schema for IT-Wallet v1.3 Wallet Attestation
 *
 * Version 1.3 specifics:
 * - x5c is REQUIRED
 * - trust_chain is OPTIONAL
 */
declare const zWalletAttestationJwtHeaderV1_3: z$1.ZodObject<{
    trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
    typ: z$1.ZodLiteral<"oauth-client-attestation+jwt">;
    x5c: z$1.ZodArray<z$1.ZodString>;
    alg: z$1.ZodString;
    jwk: z$1.ZodOptional<z$1.ZodObject<{
        alg: z$1.ZodOptional<z$1.ZodString>;
        crv: z$1.ZodOptional<z$1.ZodString>;
        d: z$1.ZodOptional<z$1.ZodString>;
        dp: z$1.ZodOptional<z$1.ZodString>;
        dq: z$1.ZodOptional<z$1.ZodString>;
        e: z$1.ZodOptional<z$1.ZodString>;
        ext: z$1.ZodOptional<z$1.ZodBoolean>;
        k: z$1.ZodOptional<z$1.ZodString>;
        key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
        kid: z$1.ZodOptional<z$1.ZodString>;
        kty: z$1.ZodString;
        n: z$1.ZodOptional<z$1.ZodString>;
        oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
            d: z$1.ZodOptional<z$1.ZodString>;
            r: z$1.ZodOptional<z$1.ZodString>;
            t: z$1.ZodOptional<z$1.ZodString>;
        }, z$1.core.$loose>>>;
        p: z$1.ZodOptional<z$1.ZodString>;
        q: z$1.ZodOptional<z$1.ZodString>;
        qi: z$1.ZodOptional<z$1.ZodString>;
        use: z$1.ZodOptional<z$1.ZodString>;
        x: z$1.ZodOptional<z$1.ZodString>;
        x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
        x5t: z$1.ZodOptional<z$1.ZodString>;
        "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
        x5u: z$1.ZodOptional<z$1.ZodString>;
        y: z$1.ZodOptional<z$1.ZodString>;
    }, z$1.core.$loose>>;
    kid: z$1.ZodOptional<z$1.ZodString>;
}, z$1.core.$loose>;
/**
 * JWT Payload schema for IT-Wallet v1.3 Wallet Attestation
 *
 * Version 1.3 specifics:
 * - Supports nbf (not before) claim
 * - Supports status claim for revocation mechanisms
 */
declare const zWalletAttestationJwtPayloadV1_3: z$1.ZodObject<{
    cnf: z$1.ZodObject<{
        jwk: z$1.ZodObject<{
            alg: z$1.ZodOptional<z$1.ZodString>;
            crv: z$1.ZodOptional<z$1.ZodString>;
            d: z$1.ZodOptional<z$1.ZodString>;
            dp: z$1.ZodOptional<z$1.ZodString>;
            dq: z$1.ZodOptional<z$1.ZodString>;
            e: z$1.ZodOptional<z$1.ZodString>;
            ext: z$1.ZodOptional<z$1.ZodBoolean>;
            k: z$1.ZodOptional<z$1.ZodString>;
            key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
            kid: z$1.ZodOptional<z$1.ZodString>;
            kty: z$1.ZodString;
            n: z$1.ZodOptional<z$1.ZodString>;
            oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
                d: z$1.ZodOptional<z$1.ZodString>;
                r: z$1.ZodOptional<z$1.ZodString>;
                t: z$1.ZodOptional<z$1.ZodString>;
            }, z$1.core.$loose>>>;
            p: z$1.ZodOptional<z$1.ZodString>;
            q: z$1.ZodOptional<z$1.ZodString>;
            qi: z$1.ZodOptional<z$1.ZodString>;
            use: z$1.ZodOptional<z$1.ZodString>;
            x: z$1.ZodOptional<z$1.ZodString>;
            x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
            x5t: z$1.ZodOptional<z$1.ZodString>;
            "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
            x5u: z$1.ZodOptional<z$1.ZodString>;
            y: z$1.ZodOptional<z$1.ZodString>;
        }, z$1.core.$loose>;
    }, z$1.core.$strip>;
    exp: z$1.ZodNumber;
    iat: z$1.ZodNumber;
    iss: z$1.ZodString;
    nbf: z$1.ZodOptional<z$1.ZodNumber>;
    status: z$1.ZodOptional<z$1.ZodObject<{
        status_list: z$1.ZodObject<{
            idx: z$1.ZodNumber;
            uri: z$1.ZodString;
        }, z$1.core.$strip>;
    }, z$1.core.$strip>>;
    sub: z$1.ZodString;
    wallet_link: z$1.ZodOptional<z$1.ZodURL>;
    wallet_name: z$1.ZodOptional<z$1.ZodString>;
    aud: z$1.ZodOptional<z$1.ZodString>;
    jti: z$1.ZodOptional<z$1.ZodString>;
    nonce: z$1.ZodOptional<z$1.ZodString>;
    trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
}, z$1.core.$loose>;
/**
 * Wallet Attestation JWT type for v1.3
 * The JWT is returned as a compact string
 */
type WalletAttestationJwtV1_3 = string;
/**
 * Zod schema for wallet attestation JWT validation (v1.3)
 * Validates that the result is a non-empty string
 */
declare const zWalletAttestationJwtV1_3: z$1.ZodString;

/**
 * Options for creating a wallet attestation with v1.3
 * Requires x5c, optional trust_chain, nbf, and status
 */
interface WalletAttestationOptionsV1_3 extends BaseWalletAttestationOptions {
    nbf?: Date;
    signer: {
        alg: string;
        kid: string;
        method: "x5c";
        trustChain?: [string, ...string[]];
        x5c: [string, ...string[]];
    };
    status?: {
        status_list: {
            idx: number;
            uri: string;
        };
    };
}
/**
 * Create a Wallet Attestation JWT for IT-Wallet v1.3
 *
 * Version 1.3 specifics:
 * - x5c in header is REQUIRED
 * - trust_chain in header is OPTIONAL
 * - Supports nbf and status claims in payload
 *
 * @param options - Wallet attestation options for v1.3
 * @returns Signed wallet attestation JWT string
 * @throws {ValidationError} When validation fails (including nbf >= exp)
 * @throws {ClientAttestationError} For other unexpected errors during creation
 * @internal This function is called by the WalletProvider router
 */
declare const createWalletAttestationJwt$1: (options: WalletAttestationOptionsV1_3) => Promise<WalletAttestationJwtV1_3>;

declare const zWalletAttestationStatusV1_4: z$1.ZodObject<{
    status_list: z$1.ZodObject<{
        idx: z$1.ZodNumber;
        uri: z$1.ZodString;
    }, z$1.core.$strip>;
}, z$1.core.$strip>;
declare const zEudiWalletInfoV1_4: z$1.ZodObject<{
    general_info: z$1.ZodObject<{
        wallet_provider_name: z$1.ZodString;
        wallet_solution_certification_information: z$1.ZodURL;
        wallet_solution_id: z$1.ZodString;
        wallet_solution_version: z$1.ZodString;
    }, z$1.core.$strip>;
}, z$1.core.$strip>;
declare const zWalletAttestationJwtHeaderV1_4: z$1.ZodObject<{
    trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
    typ: z$1.ZodLiteral<"oauth-client-attestation+jwt">;
    x5c: z$1.ZodArray<z$1.ZodString>;
    alg: z$1.ZodString;
    jwk: z$1.ZodOptional<z$1.ZodObject<{
        alg: z$1.ZodOptional<z$1.ZodString>;
        crv: z$1.ZodOptional<z$1.ZodString>;
        d: z$1.ZodOptional<z$1.ZodString>;
        dp: z$1.ZodOptional<z$1.ZodString>;
        dq: z$1.ZodOptional<z$1.ZodString>;
        e: z$1.ZodOptional<z$1.ZodString>;
        ext: z$1.ZodOptional<z$1.ZodBoolean>;
        k: z$1.ZodOptional<z$1.ZodString>;
        key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
        kid: z$1.ZodOptional<z$1.ZodString>;
        kty: z$1.ZodString;
        n: z$1.ZodOptional<z$1.ZodString>;
        oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
            d: z$1.ZodOptional<z$1.ZodString>;
            r: z$1.ZodOptional<z$1.ZodString>;
            t: z$1.ZodOptional<z$1.ZodString>;
        }, z$1.core.$loose>>>;
        p: z$1.ZodOptional<z$1.ZodString>;
        q: z$1.ZodOptional<z$1.ZodString>;
        qi: z$1.ZodOptional<z$1.ZodString>;
        use: z$1.ZodOptional<z$1.ZodString>;
        x: z$1.ZodOptional<z$1.ZodString>;
        x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
        x5t: z$1.ZodOptional<z$1.ZodString>;
        "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
        x5u: z$1.ZodOptional<z$1.ZodString>;
        y: z$1.ZodOptional<z$1.ZodString>;
    }, z$1.core.$loose>>;
    kid: z$1.ZodOptional<z$1.ZodString>;
}, z$1.core.$loose>;
declare const zWalletAttestationJwtPayloadV1_4: z$1.ZodObject<{
    cnf: z$1.ZodObject<{
        jwk: z$1.ZodObject<{
            alg: z$1.ZodOptional<z$1.ZodString>;
            crv: z$1.ZodOptional<z$1.ZodString>;
            d: z$1.ZodOptional<z$1.ZodString>;
            dp: z$1.ZodOptional<z$1.ZodString>;
            dq: z$1.ZodOptional<z$1.ZodString>;
            e: z$1.ZodOptional<z$1.ZodString>;
            ext: z$1.ZodOptional<z$1.ZodBoolean>;
            k: z$1.ZodOptional<z$1.ZodString>;
            key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
            kid: z$1.ZodOptional<z$1.ZodString>;
            kty: z$1.ZodString;
            n: z$1.ZodOptional<z$1.ZodString>;
            oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
                d: z$1.ZodOptional<z$1.ZodString>;
                r: z$1.ZodOptional<z$1.ZodString>;
                t: z$1.ZodOptional<z$1.ZodString>;
            }, z$1.core.$loose>>>;
            p: z$1.ZodOptional<z$1.ZodString>;
            q: z$1.ZodOptional<z$1.ZodString>;
            qi: z$1.ZodOptional<z$1.ZodString>;
            use: z$1.ZodOptional<z$1.ZodString>;
            x: z$1.ZodOptional<z$1.ZodString>;
            x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
            x5t: z$1.ZodOptional<z$1.ZodString>;
            "x5t#S256": z$1.ZodOptional<z$1.ZodString>;
            x5u: z$1.ZodOptional<z$1.ZodString>;
            y: z$1.ZodOptional<z$1.ZodString>;
        }, z$1.core.$loose>;
    }, z$1.core.$strip>;
    eudi_wallet_info: z$1.ZodOptional<z$1.ZodObject<{
        general_info: z$1.ZodObject<{
            wallet_provider_name: z$1.ZodString;
            wallet_solution_certification_information: z$1.ZodURL;
            wallet_solution_id: z$1.ZodString;
            wallet_solution_version: z$1.ZodString;
        }, z$1.core.$strip>;
    }, z$1.core.$strip>>;
    exp: z$1.ZodNumber;
    iat: z$1.ZodNumber;
    iss: z$1.ZodString;
    nbf: z$1.ZodOptional<z$1.ZodNumber>;
    status: z$1.ZodObject<{
        status_list: z$1.ZodObject<{
            idx: z$1.ZodNumber;
            uri: z$1.ZodString;
        }, z$1.core.$strip>;
    }, z$1.core.$strip>;
    sub: z$1.ZodString;
    wallet_link: z$1.ZodURL;
    wallet_name: z$1.ZodString;
    aud: z$1.ZodOptional<z$1.ZodString>;
    jti: z$1.ZodOptional<z$1.ZodString>;
    nonce: z$1.ZodOptional<z$1.ZodString>;
    trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
}, z$1.core.$loose>;
type WalletAttestationJwtV1_4 = string;
declare const zWalletAttestationJwtV1_4: z$1.ZodString;

interface WalletAttestationOptionsV1_4 extends Omit<BaseWalletAttestationOptions, "walletLink" | "walletName"> {
    eudiWalletInfo?: z$1.infer<typeof zEudiWalletInfoV1_4>;
    nbf?: Date;
    signer: {
        alg: string;
        kid: string;
        method: "x5c";
        trustChain?: [string, ...string[]];
        x5c: [string, ...string[]];
    };
    status: z$1.infer<typeof zWalletAttestationStatusV1_4>;
    walletLink: string;
    walletName: string;
}
/**
 * Creates a wallet attestation JWT for IT-Wallet v1.4.
 *
 * @param options - v1.4 wallet attestation creation options.
 * @returns Signed wallet attestation JWT.
 * @throws {ValidationError} If temporal constraints or generated JWT validation fail.
 * @throws {ClientAttestationError} For unexpected errors during attestation creation.
 */
declare const createWalletAttestationJwt: (options: WalletAttestationOptionsV1_4) => Promise<WalletAttestationJwtV1_4>;

declare const IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES: readonly ["ES256", "ES384", "ES512"];
declare const zItWalletClientAttestationPopJwtAlg: z.ZodEnum<{
    ES256: "ES256";
    ES384: "ES384";
    ES512: "ES512";
}>;
type ItWalletClientAttestationPopJwtAlg = z.infer<typeof zItWalletClientAttestationPopJwtAlg>;
declare const zItWalletClientAttestationPopJwtPayload: z.ZodObject<{
    aud: z.ZodString;
    exp: z.ZodOptional<z.ZodNumber>;
    iat: z.ZodNumber;
    iss: z.ZodString;
    jti: z.ZodString;
    nonce: z.ZodOptional<z.ZodString>;
    cnf: z.ZodOptional<z.ZodObject<{
        jkt: z.ZodOptional<z.ZodString>;
        jwk: z.ZodOptional<z.ZodObject<{
            alg: z.ZodOptional<z.ZodString>;
            crv: z.ZodOptional<z.ZodString>;
            d: z.ZodOptional<z.ZodString>;
            dp: z.ZodOptional<z.ZodString>;
            dq: z.ZodOptional<z.ZodString>;
            e: z.ZodOptional<z.ZodString>;
            ext: z.ZodOptional<z.ZodBoolean>;
            k: z.ZodOptional<z.ZodString>;
            key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
            kid: z.ZodOptional<z.ZodString>;
            kty: z.ZodString;
            n: z.ZodOptional<z.ZodString>;
            oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
                d: z.ZodOptional<z.ZodString>;
                r: z.ZodOptional<z.ZodString>;
                t: z.ZodOptional<z.ZodString>;
            }, z.core.$loose>>>;
            p: z.ZodOptional<z.ZodString>;
            q: z.ZodOptional<z.ZodString>;
            qi: z.ZodOptional<z.ZodString>;
            use: z.ZodOptional<z.ZodString>;
            x: z.ZodOptional<z.ZodString>;
            x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
            x5t: z.ZodOptional<z.ZodString>;
            "x5t#S256": z.ZodOptional<z.ZodString>;
            x5u: z.ZodOptional<z.ZodString>;
            y: z.ZodOptional<z.ZodString>;
        }, z.core.$loose>>;
    }, z.core.$loose>>;
    nbf: z.ZodOptional<z.ZodNumber>;
    status: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
    trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
}, z.core.$loose>;
type ItWalletClientAttestationPopJwtPayload = z.infer<typeof zItWalletClientAttestationPopJwtPayload>;
declare const zItWalletClientAttestationPopJwtTyp: z.ZodLiteral<"oauth-client-attestation-pop+jwt">;
declare const zItWalletClientAttestationPopJwtHeader: z.ZodObject<{
    typ: z.ZodLiteral<"oauth-client-attestation-pop+jwt">;
    alg: z.ZodString;
    jwk: z.ZodOptional<z.ZodObject<{
        alg: z.ZodOptional<z.ZodString>;
        crv: z.ZodOptional<z.ZodString>;
        d: z.ZodOptional<z.ZodString>;
        dp: z.ZodOptional<z.ZodString>;
        dq: z.ZodOptional<z.ZodString>;
        e: z.ZodOptional<z.ZodString>;
        ext: z.ZodOptional<z.ZodBoolean>;
        k: z.ZodOptional<z.ZodString>;
        key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
        kid: z.ZodOptional<z.ZodString>;
        kty: z.ZodString;
        n: z.ZodOptional<z.ZodString>;
        oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
            d: z.ZodOptional<z.ZodString>;
            r: z.ZodOptional<z.ZodString>;
            t: z.ZodOptional<z.ZodString>;
        }, z.core.$loose>>>;
        p: z.ZodOptional<z.ZodString>;
        q: z.ZodOptional<z.ZodString>;
        qi: z.ZodOptional<z.ZodString>;
        use: z.ZodOptional<z.ZodString>;
        x: z.ZodOptional<z.ZodString>;
        x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
        x5t: z.ZodOptional<z.ZodString>;
        "x5t#S256": z.ZodOptional<z.ZodString>;
        x5u: z.ZodOptional<z.ZodString>;
        y: z.ZodOptional<z.ZodString>;
    }, z.core.$loose>>;
    kid: z.ZodOptional<z.ZodString>;
    trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
    x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
}, z.core.$loose>;
type ItWalletClientAttestationPopJwtHeader = z.infer<typeof zItWalletClientAttestationPopJwtHeader>;

interface DecodeJwtHeaderOptions<HeaderSchema extends BaseSchema | undefined> {
    /**
     * Optional prefix for error messages thrown during decoding, to provide more context on where the error occurred
     */
    errorMessagePrefix?: string;
    /**
     * Schema to use for validating the header. If not provided the
     * default `zJwtHeader` schema will be used
     */
    headerSchema?: HeaderSchema;
    /**
     * The compact encoded jwt
     */
    jwt: string;
}
interface DecodeJwtHeaderResult<HeaderSchema extends BaseSchema | undefined = undefined> {
    header: InferSchemaOrDefaultOutput<HeaderSchema, typeof zJwtHeader>;
}
/**
 * Decodes and validates the header of a compact JWT.
 *
 * This helper does not verify the JWT signature or parse the payload.
 *
 * @param options - Header decode options.
 * @param options.errorMessagePrefix - Optional context prefix for thrown parse/validation errors.
 * @param options.headerSchema - Optional schema for the JWT header; defaults to `zJwtHeader`.
 * @param options.jwt - Compact JWT to decode.
 * @returns Decoded and schema-validated JWT header.
 * @throws {Oauth2JwtParseError} If the JWT shape or header JSON is invalid.
 * @throws {ValidationError} If header schema validation fails.
 */
declare function decodeJwtHeader<HeaderSchema extends BaseSchema | undefined = undefined>(options: DecodeJwtHeaderOptions<HeaderSchema>): DecodeJwtHeaderResult<HeaderSchema>;
/**
 * Builds a JWT header from an SDK signer descriptor.
 *
 * @param signer - Signer descriptor used by SDK signing callbacks.
 * @returns Header fields required by the signer method.
 */
declare function jwtHeaderFromJwtSigner(signer: JwtSigner): {
    alg: string;
    kid: string;
    trust_chain?: undefined;
    jwk?: undefined;
    x5c?: undefined;
} | {
    alg: string;
    kid: string;
    trust_chain: [string, ...string[]] | undefined;
    jwk?: undefined;
    x5c?: undefined;
} | {
    alg: string;
    jwk: {
        [x: string]: unknown;
        kty: string;
        alg?: string | undefined;
        crv?: string | undefined;
        d?: string | undefined;
        dp?: string | undefined;
        dq?: string | undefined;
        e?: string | undefined;
        ext?: boolean | undefined;
        k?: string | undefined;
        key_ops?: string[] | undefined;
        kid?: string | undefined;
        n?: string | undefined;
        oth?: {
            [x: string]: unknown;
            d?: string | undefined;
            r?: string | undefined;
            t?: string | undefined;
        }[] | undefined;
        p?: string | undefined;
        q?: string | undefined;
        qi?: string | undefined;
        use?: string | undefined;
        x?: string | undefined;
        x5c?: string[] | undefined;
        x5t?: string | undefined;
        "x5t#S256"?: string | undefined;
        x5u?: string | undefined;
        y?: string | undefined;
    };
    kid?: undefined;
    trust_chain?: undefined;
    x5c?: undefined;
} | {
    alg: string;
    kid: string | undefined;
    trust_chain: [string, ...string[]] | undefined;
    x5c: string[];
    jwk?: undefined;
} | {
    alg: string;
    kid?: undefined;
    trust_chain?: undefined;
    jwk?: undefined;
    x5c?: undefined;
};

declare const zCompactJwe: z$1.ZodString;

/**
 * Generic error thrown on OAuth2 operations
 */
declare class Oauth2Error extends Error {
    readonly statusCode?: number;
    constructor(message: string, options?: {
        statusCode?: number;
    } & ErrorOptions);
}
/**
 * Custom error thrown when pushed authorization request operations fail
 */
declare class PushedAuthorizationRequestError extends Oauth2Error {
    readonly statusCode?: number;
    constructor(message: string, options?: {
        statusCode?: number;
    } & ErrorOptions);
}
/**
 * Error thrown in case {@link createTokenDPoP} is called without neither a custom jti
 * nor a generateRandom callback or when the signJwt callback throws
 */
declare class CreateTokenDPoPError extends Oauth2Error {
    constructor(message: string, options?: ErrorOptions);
}
/**
 * Error thrown during MRTD (Machine Readable Travel Document) Proof of Possession operations.
 * Used in eID Substantial Authentication with MRTD Verification flow (IT-Wallet L2+ specification).
 */
declare class MrtdPopError extends Oauth2Error {
    readonly statusCode?: number;
    constructor(message: string, options?: {
        statusCode?: number;
    } & ErrorOptions);
}
/**
 * Custom error thrown when pushed authorization request operations fail
 */
declare class FetchTokenResponseError extends Oauth2Error {
    readonly statusCode?: number;
    constructor(message: string, options?: {
        statusCode?: number;
    } & ErrorOptions);
}
/**
 * Error thrown when access token response creation fails.
 */
declare class CreateTokenResponseError extends Oauth2Error {
    readonly statusCode?: number;
    constructor(message: string, options?: {
        statusCode?: number;
    } & ErrorOptions);
}
/**
 * Error thrown when an unexpected error occurs during client attestation (wallet attestation) creation.
 */
declare class ClientAttestationError extends Oauth2Error {
    constructor(message: string, options?: ErrorOptions);
}

interface CreateJarRequestOptions {
    /**
     * Additional claims merged into the request object payload before
     * `authorizationRequestPayload`.
     */
    additionalJwtPayload?: Record<string, unknown>;
    /**
     * Authorization request claims used as JWT header parameters.
     */
    authorizationRequestHeader: JarRequestObjectHeader;
    /**
     * Authorization request claims used as JWT payload.
     */
    authorizationRequestPayload: JarRequestObjectPayload;
    /**
     * Cryptographic callbacks used to sign and optionally encrypt the JAR.
     */
    callbacks: Partial<Pick<CallbackContext, "encryptJwe">> & Pick<CallbackContext, "signJwt">;
    /**
     * Request object lifetime in seconds from `now`.
     */
    expiresInSeconds: number;
    /**
     * Encryptor configuration. When provided, the signed request object is wrapped
     * as JWE and returned as encrypted `request` value.
     */
    jweEncryptor?: JweEncryptor;
    /**
     * Signer configuration used to produce the request object JWT.
     */
    jwtSigner: JwtSigner;
    /**
     * Date that should be used as now. If not provided current date will be used.
     */
    now?: Date;
    /**
     * Optional request URI for by-reference JAR transmission.
     * When provided, `jarAuthorizationRequest` will include `request_uri` instead of `request`.
     */
    requestUri?: string;
}
interface CreateJarRequestResult {
    /**
     * The signed (and optionally encrypted) JWT string representing the authorization request.
     * This value is included in `jarAuthorizationRequest` when `requestUri` is not provided.
     */
    authorizationRequestJwt: string;
    /**
     * The JWK used for encryption when `jweEncryptor` is provided, otherwise undefined.
     */
    encryptionJwk?: Jwk;
    /**
     * The JAR authorization request parameters to be sent to the authorization endpoint.
     * Contains either `request` or `request_uri` depending on the presence of `requestUri` in options.
     */
    jarAuthorizationRequest: JarAuthorizationRequest;
    /**
     * The JWK used for signing the request object JWT.
     */
    signerJwk: Jwk;
}
/**
 * Creates a JWT Secured Authorization Request (JAR) request payload.
 *
 * The request object is always signed, and optionally encrypted when `jweEncryptor`
 * is provided. The returned `jarAuthorizationRequest` is created in one of two forms:
 * - by-value, with `request`
 * - by-reference, with `request_uri`
 *
 * @param options - Parameters used to create the JAR request
 * @param options.additionalJwtPayload - Additional JWT claims merged before authorization claims
 * @param options.authorizationRequestPayload - Base authorization request JWT payload
 * @param options.authorizationRequestHeader - JWT header parameters for the request object
 * @param options.callbacks - Callback context with required `signJwt` and optional `encryptJwe`
 * @param options.expiresInSeconds - JWT expiration offset in seconds
 * @param options.jweEncryptor - Optional JWE encryptor to wrap the signed JWT
 * @param options.jwtSigner - JWT signer used for request object signing
 * @param options.now - Optional reference time used for `iat` and `exp`
 * @param options.requestUri - Optional request URI for by-reference transmission
 *
 * @returns Signed (and optionally encrypted) authorization request data, signer key material,
 * and JAR request parameters for transmission.
 */
declare function createJarRequest(options: CreateJarRequestOptions): Promise<CreateJarRequestResult>;

/**
 * Fetches a JWT-Secured Authorization Request object from a `request_uri`.
 *
 * @param options - Request object fetch options.
 * @param options.fetch - Optional fetch implementation; defaults to the runtime fetch through `createFetcher`.
 * @param options.requestUri - URI hosting the signed authorization request object.
 * @returns Compact JAR request object JWT.
 * @throws {UnexpectedStatusCodeError} If the endpoint does not return HTTP 200.
 * @throws {Oauth2Error} If the request object cannot be fetched.
 */
declare function fetchJarRequestObject(options: {
    fetch?: Fetch;
    requestUri: string;
}): Promise<string>;

interface ParsedJarRequestOptions {
    callbacks: Pick<CallbackContext, "fetch">;
    jarRequestParams: JarAuthorizationRequest;
}
interface ParsedJarRequest {
    authorizationRequestJwt: string;
    sendBy: "reference" | "value";
}
/**
 * Checks whether authorization request parameters contain a JAR request object or URI.
 *
 * @param request - Authorization request parameters to inspect.
 * @returns True when `request` or `request_uri` is present.
 */
declare function isJarAuthorizationRequest(request: JarAuthorizationRequest): request is JarAuthorizationRequest;
/**
 * Parse a JAR (JWT Secured Authorization Request) request by validating and optionally fetch from uri.
 *
 * @param options - The input parameters
 * @param options.jarRequestParams - The JAR authorization request parameters
 * @param options.callbacks - Context containing the relevant Jose crypto operations
 * @returns An object containing the transmission method ('value' or 'reference') and the JWT request object.
 */
declare function parseJarRequest(options: ParsedJarRequestOptions): Promise<ParsedJarRequest>;

/**
 * Validates that JAR parameters identify exactly one request transmission mode.
 *
 * @param options - Validation options.
 * @param options.jarRequestParams - JAR request parameters to validate.
 * @returns The request URI when the request is sent by reference.
 * @throws {Oauth2Error} If both `request` and `request_uri` are present or both are missing.
 */
declare function validateJarRequestParams(options: {
    jarRequestParams: JarAuthorizationRequest;
}): ({
    request: string;
    request_uri?: never;
} | {
    request?: never;
    request_uri: string;
}) & JarAuthorizationRequest;

/**
 * Options for extracting and decoding the JWT from a form_post.jwt response
 */
interface GetJwtFromFormPostOptions<T> {
    /**
     * Raw HTML containing the autosubmitted form with the jwt response
     */
    formData: string;
    /**
     * Schema for parsing and validating
     */
    schema: z.ZodSchema<T>;
}
/**
 * Decode a form_post.jwt and return the final JWT.
 * The formData here is in form_post.jwt format as defined in
 * JWT Secured Authorization Response Mode for OAuth 2.0 (JARM)
 *
 * @param options - Form post extraction options.
 * @param options.formData - Raw HTML form_post.jwt response body.
 * @param options.schema - Zod schema used to validate the decoded JWT payload.
 * @returns The compact JWT and decoded JWT data.
 * @throws {Oauth2Error} If the response input cannot be found in the form data.
 *
 * @example
 * ```html
 * <!DOCTYPE html>
    <html>
        <head>
            <meta charset="utf-8" />
        </head>
        <body onload="document.forms[0].submit()">
        <noscript>
            <p>
                <strong>Note:</strong> Since your browser does not support JavaScript, you must press the Continue button once to proceed.
            </p>
        </noscript>
            <form action="iowalletexample//cb" method="post">
                <div>
                    <input type="hidden" name="response" value="somevalue" />
                </div>
                <noscript>
                    <div>
                        <input type="submit" value="Continue" />
                    </div>
                </noscript>
            </form>
        </body>
    </html>
 * ```
 */
declare const getJwtFromFormPost: <T>(options: GetJwtFromFormPostOptions<T>) => Promise<{
    decodedJwt: DecodeJwtResult<undefined, z.ZodSchema<T>>;
    jwt: string;
}>;

/**
 * NFC-read document evidence from CIE (Italian ID card) containing:
 * - Data Groups (DG1, DG11) with personal information
 * - Security Objects of Document (SOD) for MRTD and IAS applications
 * - IAS public key and Anti-Cloning challenge signature
 *
 * It is alligned to the IT-Wallet v1.3 specs
 * @see IT-Wallet L2+ specification Section 12.1.3.5.3.5 (Validation JWT Structure)
 */
interface MrtdDocumentData {
    /** Anti-Cloning signed challenge response (base64) */
    challengeSigned: string;
    /** Data Group 1 - MRZ info (base64) */
    dg1: string;
    /** Data Group 11 - additional personal data (base64) */
    dg11: string;
    /** IAS public key in DER format (base64) */
    iasPk: string;
    /** Security Object of Document for IAS (base64) */
    sodIas: string;
    /** Security Object of Document for MRTD (base64) */
    sodMrtd: string;
}
interface CreateMrtdValidationJwtOptions {
    /** PID Provider identifier (JWT aud) */
    audience: string;
    callbacks: Pick<CallbackContext, "signJwt">;
    /** Wallet Instance identifier (JWT iss) */
    clientId: string;
    /** NFC-read document evidence */
    documentData: MrtdDocumentData;
    issuedAt?: Date;
    signer: JwtSignerJwk$1;
}
/**
 * Creates a signed JWT containing MRTD validation data for Phase 3 of L2+ flow.
 *
 * The JWT is sent to the PID Provider for cryptographic verification of the CIE document.
 * Includes Data Groups (DG1, DG11), Security Objects, and Anti-Cloning challenge response.
 *
 * @param options - Configuration including document data, signer, and callback context
 * @returns Signed JWT with typ="mrtd-ias+jwt"
 * @throws {MrtdPopError} If signer lacks kid or signing fails
 *
 * @see IT-Wallet L2+ specification Section 12.1.3.5.3.4 (MRTD PoP Validation Request)
 */
declare function createMrtdValidationJwt(options: CreateMrtdValidationJwtOptions): Promise<{
    jwt: string;
}>;

interface FetchMrtdPopInitOptions {
    callbacks: Pick<CallbackContext, "fetch" | "verifyJwt">;
    clientAttestationDPoP: string;
    /** From challenge JWT payload */
    mrtdAuthSession: string;
    /** From challenge JWT payload */
    mrtdPopJwtNonce: string;
    /** From challenge JWT payload htu */
    popInitEndpoint: string;
    /**
     * Optional custom signer for verifying the MRTD PoP init response JWT.
     * If not provided, the library will attempt to verify using JWT header.
     */
    signer?: JwtSigner$1;
    /**
     * Attestation header value for the wallet's own attestation, to be included in the request.
     */
    walletAttestation: string;
}
interface FetchMrtdPopInitResult {
    challenge: string;
    mrtdPopNonce: string;
    mrz?: string;
    /** htu from the init response — the verify endpoint */
    popVerifyEndpoint: string;
    signer: JwtSigner$1;
}
/**
 * Initiates MRTD Proof of Possession validation (Phase 3.2 of L2+ flow).
 *
 * Sends session correlation parameters to the MRTD PoP Service and receives:
 * - Cryptographic challenge for Anti-Cloning Internal Authentication
 * - Nonce for next step
 * - Optional MRZ data from CIE National Registry
 *
 * @param options - Session parameters, attestation headers, and callbacks
 * @returns Challenge, nonce, optional MRZ, and verify endpoint URL
 * @throws {UnexpectedStatusCodeError} If response is not HTTP 202
 * @throws {MrtdPopError} For network or parsing failures
 *
 * It is alligned to the IT-Wallet v1.3 specs
 * @see IT-Wallet L2+ specification Section 12.1.3.5.3.2-3 (MRTD PoP Request/Response)
 */
declare function fetchMrtdPopInit(options: FetchMrtdPopInitOptions): Promise<FetchMrtdPopInitResult>;

interface FetchMrtdPopVerifyOptions {
    callbacks: Pick<CallbackContext, "fetch">;
    clientAttestationDPoP: string;
    mrtdAuthSession: string;
    mrtdPopNonce: string;
    mrtdValidationJwt: string;
    popVerifyEndpoint: string;
    walletAttestation: string;
}
interface FetchMrtdPopVerifyResult {
    mrtdValPopNonce: string;
    redirectUri: string;
}
/**
 * Submits MRTD validation evidence for final verification (Phase 3.4 of L2+ flow).
 *
 * Sends the validation JWT containing NFC-read document data to the MRTD PoP Service.
 * The service performs cryptographic verification, identity correlation, and document status checks.
 *
 * @param options - Validation JWT, session correlation parameters, and attestation headers
 * @returns Final nonce and redirect URI for browser-based confirmation
 * @throws {UnexpectedStatusCodeError} If response is not HTTP 202
 * @throws {ValidationError} If response body is invalid
 * @throws {MrtdPopError} For network failures
 *
 * It is alligned to the IT-Wallet v1.3 specs
 * @see IT-Wallet L2+ specification Section 12.1.3.5.3.4 (MRTD PoP Validation Request)
 */
declare function fetchMrtdPopVerify(options: FetchMrtdPopVerifyOptions): Promise<FetchMrtdPopVerifyResult>;

/**
 * Zod schemas for MRTD (Machine Readable Travel Document) Proof of Possession flow.
 *
 * Implements IT-Wallet L2+ specification for eID Substantial Authentication with MRTD Verification.
 * Defines JWT structures and response formats for the multi-step document validation protocol.
 *
 * @see IT-Wallet L2+ specification Section 12.1.3 (eID Substantial Authentication with MRTD Verification)
 */
/** JWT header for MRTD challenge (Phase 3.1) */
declare const zMrtdChallengeJwtHeader: z.ZodObject<{
    alg: z.ZodString;
    kid: z.ZodString;
    typ: z.ZodLiteral<"mrtd-ias+jwt">;
}, z.core.$loose>;
type MrtdChallengeJwtHeader = z.infer<typeof zMrtdChallengeJwtHeader>;
/** JWT payload for MRTD challenge containing session correlation and endpoint parameters */
declare const zMrtdChallengeJwtPayload: z.ZodObject<{
    aud: z.ZodString;
    exp: z.ZodNumber;
    htm: z.ZodLiteral<"POST">;
    htu: z.ZodURL;
    iat: z.ZodNumber;
    iss: z.ZodString;
    mrtd_auth_session: z.ZodString;
    mrtd_pop_jwt_nonce: z.ZodString;
    state: z.ZodString;
    status: z.ZodLiteral<"require_interaction">;
    type: z.ZodLiteral<"mrtd+ias">;
}, z.core.$loose>;
type MrtdChallengeJwtPayload = z.infer<typeof zMrtdChallengeJwtPayload>;
/** JWT header for MRTD PoP initialization response (Phase 3.3) */
declare const zMrtdPopInitResponseJwtHeader: z.ZodObject<{
    alg: z.ZodString;
    kid: z.ZodString;
    typ: z.ZodLiteral<"mrtd-ias-pop+jwt">;
}, z.core.$loose>;
type MrtdPopInitResponseJwtHeader = z.infer<typeof zMrtdPopInitResponseJwtHeader>;
/** JWT payload for MRTD PoP initialization response containing challenge and nonce */
declare const zMrtdPopInitResponseJwtPayload: z.ZodObject<{
    aud: z.ZodString;
    challenge: z.ZodString;
    exp: z.ZodNumber;
    htm: z.ZodLiteral<"POST">;
    htu: z.ZodURL;
    iat: z.ZodNumber;
    iss: z.ZodString;
    mrtd_pop_nonce: z.ZodString;
    mrz: z.ZodOptional<z.ZodString>;
}, z.core.$loose>;
type MrtdPopInitResponseJwtPayload = z.infer<typeof zMrtdPopInitResponseJwtPayload>;
/** JWT header for MRTD validation (signed by Wallet Instance) */
declare const zMrtdValidationJwtHeader: z.ZodObject<{
    alg: z.ZodString;
    kid: z.ZodString;
    typ: z.ZodLiteral<"mrtd-ias+jwt">;
}, z.core.$loose>;
type MrtdValidationJwtHeader = z.infer<typeof zMrtdValidationJwtHeader>;
/** JWT payload for MRTD validation containing NFC-read document evidence */
declare const zMrtdValidationJwtPayload: z.ZodObject<{
    aud: z.ZodString;
    document_type: z.ZodLiteral<"cie">;
    exp: z.ZodNumber;
    ias: z.ZodObject<{
        challenge_signed: z.ZodString;
        ias_pk: z.ZodString;
        sod_ias: z.ZodString;
    }, z.core.$loose>;
    iat: z.ZodNumber;
    iss: z.ZodString;
    mrtd: z.ZodObject<{
        dg1: z.ZodString;
        dg11: z.ZodString;
        sod_mrtd: z.ZodString;
    }, z.core.$loose>;
}, z.core.$loose>;
type MrtdValidationJwtPayload = z.infer<typeof zMrtdValidationJwtPayload>;
/** Response from MRTD PoP verification endpoint (Phase 3.8) */
declare const zMrtdPopVerifyResponse: z.ZodObject<{
    mrtd_val_pop_nonce: z.ZodString;
    redirect_uri: z.ZodURL;
    status: z.ZodLiteral<"require_interaction">;
    type: z.ZodLiteral<"redirect_to_web">;
}, z.core.$loose>;
type MrtdPopVerifyResponse = z.infer<typeof zMrtdPopVerifyResponse>;

interface ParseMrtdChallengeOptions {
    /** The full redirect URL containing ?challenge_info=<jwt> */
    redirectUrl: string;
}
interface ParseMrtdChallengeResult {
    challengeJwt: string;
    header: MrtdChallengeJwtHeader;
    payload: MrtdChallengeJwtPayload;
}
/**
 * Extracts and decodes the MRTD challenge JWT from authorization redirect (Phase 3.1 of L2+ flow).
 *
 * After primary authentication (LoA3), the Authorization Server redirects to the Wallet
 * with a JWT containing challenge requirements for document validation.
 *
 * @param options - Redirect URL containing challenge_info query parameter
 * @returns Decoded JWT header and payload (signature not yet verified)
 * @throws {MrtdPopError} If challenge_info is missing or JWT format is invalid
 *
 * It is alligned to the IT-Wallet v1.3 specs
 * @see IT-Wallet L2+ specification Section 12.1.3.5.3.1 (MRTD Proof JWT)
 */
declare function parseMrtdChallenge(options: ParseMrtdChallengeOptions): ParseMrtdChallengeResult;

interface VerifyMrtdChallengeOptions {
    callbacks: Pick<CallbackContext, "verifyJwt">;
    challengeJwt: string;
    /** Expected client_id — must match JWT aud */
    clientId: string;
    /**
     * Optional custom signer for verifying the MRTD challenge JWT.
     * If not provided, the library will attempt to verify using JWT header.
     */
    signer?: JwtSigner$1;
}
interface VerifyMrtdChallengeResult {
    header: MrtdChallengeJwtHeader;
    payload: MrtdChallengeJwtPayload;
    signer: JwtSigner$1;
}
/**
 * Verifies the MRTD challenge JWT signature and validates claims.
 *
 * Ensures the challenge was issued by the trusted PID Provider and is intended
 * for this Wallet Instance. Validates expiration, audience, and required parameters.
 *
 * @param options - Challenge JWT, expected client_id, and verification callback
 * @returns Verified header and payload
 * @throws {Error} If aud doesn't match clientId
 * @throws {Oauth2JwtVerificationError} If signature verification fails
 *
 * It is alligned to the IT-Wallet v1.3 specs
 * @see IT-Wallet L2+ specification Section 12.1.3.5.3.1 (MRTD Proof JWT)
 */
declare function verifyMrtdChallenge(options: VerifyMrtdChallengeOptions): Promise<VerifyMrtdChallengeResult>;

/**
 * Options for Token Request DPoP generation
 */
interface CreateTokenDPoPOptions {
    /**
     * The access token to which the dpop jwt should be bound. Required
     * when the dpop will be sent along with an access token.
     */
    accessToken?: string;
    /**
     * Object containing callbacks for DPoP generation and signature
     */
    callbacks: Partial<Pick<CallbackContext, "generateRandom">> & Pick<CallbackContext, "hash" | "signJwt">;
    /**
     * Creation time of the JWT. If not provided the current date will be used
     */
    issuedAt?: Date;
    /**
     * jti claim for the DPoP JWT. If not provided, a random one will be generated
     * if a generateRandom callback is provided
     */
    jti?: string;
    /**
     * The signer of the dpop jwt. Only jwk signer allowed.
     */
    signer: JwtSignerJwk$1;
    /**
     * The request for which to create the dpop jwt
     */
    tokenRequest: {
        method: HttpMethod$1;
        url: string;
    };
}
/**
 * Creates a signed Token DPoP with the given cryptographic material and data.
 * It is used to create DPoP proofs for token requests and credential requests.
 * @param options {@link CreateTokenDPoPOptions}
 * @returns A Promise that resolves with an object containing the signed DPoP JWT and
 *          its corresponding public JWK
 * @throws {@link CreateTokenDPoPError} in case neither a default jti nor a generateRandom
 *         callback have been provided or the signJwt callback throws
 */
declare function createTokenDPoP(options: CreateTokenDPoPOptions): Promise<{
    jwt: string;
    signerJwk: _openid4vc_oauth2.Jwk;
}>;
/**
 * Extracts and validates the DPoP JWT from request headers.
 *
 * @param headers - Request headers to inspect.
 * @returns The DPoP JWT when present and well-formed, `{ valid: true }` when absent,
 * or `{ valid: false }` when the header is malformed.
 */
declare function extractDpopJwtFromHeaders(headers: FetchHeaders): {
    dpopJwt?: string;
    valid: true;
} | {
    valid: false;
};

/**
 * Normalizes a request URL into the DPoP `htu` claim value.
 *
 * @param requestUrl - Full request URL.
 * @returns URL string without query string or fragment.
 */
declare const htuFromRequestUrl: (requestUrl: string) => string;

interface VerifyTokenDPoPOptions {
    /**
     * Access token to which the dpop jwt is bound. If provided the sha-256 hash of the
     * access token needs to match the 'ath' claim.
     */
    accessToken?: string;
    /**
     * Allowed dpop signing alg values. If not provided
     * any alg values are allowed and it's up to the `verifyJwtCallback`
     * to handle the alg.
     */
    allowedSigningAlgs?: string[];
    /**
     * Callbacks used for verifying dpop jwt
     */
    callbacks: Pick<CallbackContext, "hash" | "verifyJwt">;
    /**
     * The compact dpop jwt.
     */
    dpopJwt: string;
    /**
     * The expected jwk thumprint 'jti' confirmation method. If provided the thumprint of the
     * jwk used to sign the dpop jwt must match this provided thumbprint value. The 'jti' value
     * can be extracted from the access token payload, or if opaque tokens are used can be retrieved
     * using token introspection.
     */
    expectedJwkThumbprint?: string;
    /**
     * Expected nonce in the payload. If not provided the nonce won't be validated.
     */
    expectedNonce?: string;
    /**
     * The current time to use when verifying the JWTs.
     * If not provided current time will be used.
     *
     * @default new Date()
     */
    now?: Date;
    /**
     * The request for which to verify the dpop jwt
     */
    request: RequestLike$1;
}
/**
 * Verifies a DPoP proof JWT against an HTTP request and optional token binding data.
 *
 * @param options - DPoP verification options.
 * @param options.accessToken - Optional access token whose hash must match the `ath` claim.
 * @param options.allowedSigningAlgs - Optional allow-list for DPoP signing algorithms.
 * @param options.callbacks - Hashing and JWT verification callbacks.
 * @param options.dpopJwt - Compact DPoP JWT.
 * @param options.expectedJwkThumbprint - Optional expected confirmation JWK thumbprint.
 * @param options.expectedNonce - Optional nonce expected in the payload.
 * @param options.now - Date used for temporal validation.
 * @param options.request - HTTP request that the DPoP proof must bind to.
 * @returns Decoded JWT header, payload, and resolved signer.
 * @throws {Oauth2Error} If any DPoP claim, token binding, or signature validation fails.
 */
declare function verifyTokenDPoP(options: VerifyTokenDPoPOptions): Promise<{
    header: {
        [x: string]: unknown;
        jwk: {
            [x: string]: unknown;
            kty: string;
            alg?: string | undefined;
            crv?: string | undefined;
            d?: string | undefined;
            dp?: string | undefined;
            dq?: string | undefined;
            e?: string | undefined;
            ext?: boolean | undefined;
            k?: string | undefined;
            key_ops?: string[] | undefined;
            kid?: string | undefined;
            n?: string | undefined;
            oth?: {
                [x: string]: unknown;
                d?: string | undefined;
                r?: string | undefined;
                t?: string | undefined;
            }[] | undefined;
            p?: string | undefined;
            q?: string | undefined;
            qi?: string | undefined;
            use?: string | undefined;
            x?: string | undefined;
            x5c?: string[] | undefined;
            x5t?: string | undefined;
            "x5t#S256"?: string | undefined;
            x5u?: string | undefined;
            y?: string | undefined;
        };
        typ: "dpop+jwt";
        alg: string;
        kid?: string | undefined;
        trust_chain?: [string, ...string[]] | undefined;
        x5c?: string[] | undefined;
    };
    jwkThumbprint: string;
    payload: {
        [x: string]: unknown;
        htm: "GET" | "POST" | "PUT" | "DELETE" | "HEAD" | "OPTIONS" | "TRACE" | "CONNECT" | "PATCH";
        htu: string;
        iat: number;
        jti: string;
        ath?: string | undefined;
        aud?: string | undefined;
        cnf?: {
            [x: string]: unknown;
            jkt?: string | undefined;
            jwk?: {
                [x: string]: unknown;
                kty: string;
                alg?: string | undefined;
                crv?: string | undefined;
                d?: string | undefined;
                dp?: string | undefined;
                dq?: string | undefined;
                e?: string | undefined;
                ext?: boolean | undefined;
                k?: string | undefined;
                key_ops?: string[] | undefined;
                kid?: string | undefined;
                n?: string | undefined;
                oth?: {
                    [x: string]: unknown;
                    d?: string | undefined;
                    r?: string | undefined;
                    t?: string | undefined;
                }[] | undefined;
                p?: string | undefined;
                q?: string | undefined;
                qi?: string | undefined;
                use?: string | undefined;
                x?: string | undefined;
                x5c?: string[] | undefined;
                x5t?: string | undefined;
                "x5t#S256"?: string | undefined;
                x5u?: string | undefined;
                y?: string | undefined;
            } | undefined;
        } | undefined;
        exp?: number | undefined;
        iss?: string | undefined;
        nbf?: number | undefined;
        nonce?: string | undefined;
        status?: Record<string, any> | undefined;
        trust_chain?: [string, ...string[]] | undefined;
    };
}>;

declare const zDpopJwtPayload: z.ZodObject<{
    ath: z.ZodOptional<z.ZodString>;
    htm: z.ZodEnum<{
        GET: "GET";
        POST: "POST";
        PUT: "PUT";
        DELETE: "DELETE";
        HEAD: "HEAD";
        OPTIONS: "OPTIONS";
        TRACE: "TRACE";
        CONNECT: "CONNECT";
        PATCH: "PATCH";
    }>;
    htu: z.ZodURL;
    iat: z.ZodNumber;
    jti: z.ZodString;
    aud: z.ZodOptional<z.ZodString>;
    cnf: z.ZodOptional<z.ZodObject<{
        jkt: z.ZodOptional<z.ZodString>;
        jwk: z.ZodOptional<z.ZodObject<{
            alg: z.ZodOptional<z.ZodString>;
            crv: z.ZodOptional<z.ZodString>;
            d: z.ZodOptional<z.ZodString>;
            dp: z.ZodOptional<z.ZodString>;
            dq: z.ZodOptional<z.ZodString>;
            e: z.ZodOptional<z.ZodString>;
            ext: z.ZodOptional<z.ZodBoolean>;
            k: z.ZodOptional<z.ZodString>;
            key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
            kid: z.ZodOptional<z.ZodString>;
            kty: z.ZodString;
            n: z.ZodOptional<z.ZodString>;
            oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
                d: z.ZodOptional<z.ZodString>;
                r: z.ZodOptional<z.ZodString>;
                t: z.ZodOptional<z.ZodString>;
            }, z.core.$loose>>>;
            p: z.ZodOptional<z.ZodString>;
            q: z.ZodOptional<z.ZodString>;
            qi: z.ZodOptional<z.ZodString>;
            use: z.ZodOptional<z.ZodString>;
            x: z.ZodOptional<z.ZodString>;
            x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
            x5t: z.ZodOptional<z.ZodString>;
            "x5t#S256": z.ZodOptional<z.ZodString>;
            x5u: z.ZodOptional<z.ZodString>;
            y: z.ZodOptional<z.ZodString>;
        }, z.core.$loose>>;
    }, z.core.$loose>>;
    exp: z.ZodOptional<z.ZodNumber>;
    iss: z.ZodOptional<z.ZodString>;
    nbf: z.ZodOptional<z.ZodNumber>;
    nonce: z.ZodOptional<z.ZodString>;
    status: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
    trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
}, z.core.$loose>;
type DpopJwtPayload = z.infer<typeof zDpopJwtPayload>;
declare const zDpopJwtHeader: z.ZodObject<{
    jwk: z.ZodObject<{
        alg: z.ZodOptional<z.ZodString>;
        crv: z.ZodOptional<z.ZodString>;
        d: z.ZodOptional<z.ZodString>;
        dp: z.ZodOptional<z.ZodString>;
        dq: z.ZodOptional<z.ZodString>;
        e: z.ZodOptional<z.ZodString>;
        ext: z.ZodOptional<z.ZodBoolean>;
        k: z.ZodOptional<z.ZodString>;
        key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
        kid: z.ZodOptional<z.ZodString>;
        kty: z.ZodString;
        n: z.ZodOptional<z.ZodString>;
        oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
            d: z.ZodOptional<z.ZodString>;
            r: z.ZodOptional<z.ZodString>;
            t: z.ZodOptional<z.ZodString>;
        }, z.core.$loose>>>;
        p: z.ZodOptional<z.ZodString>;
        q: z.ZodOptional<z.ZodString>;
        qi: z.ZodOptional<z.ZodString>;
        use: z.ZodOptional<z.ZodString>;
        x: z.ZodOptional<z.ZodString>;
        x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
        x5t: z.ZodOptional<z.ZodString>;
        "x5t#S256": z.ZodOptional<z.ZodString>;
        x5u: z.ZodOptional<z.ZodString>;
        y: z.ZodOptional<z.ZodString>;
    }, z.core.$loose>;
    typ: z.ZodLiteral<"dpop+jwt">;
    alg: z.ZodString;
    kid: z.ZodOptional<z.ZodString>;
    trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
    x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
}, z.core.$loose>;
type DpopJwtHeader = z.infer<typeof zDpopJwtHeader>;

export { type AccessTokenProfileJwtHeader, type AccessTokenProfileJwtPayload, type AccessTokenRequest, type AccessTokenResponse, type AuthorizationCodeGrantIdentifier, type AuthorizationCodeGrantType, type AuthorizationRequestV1_0, type AuthorizationRequestV1_3, type BaseVerifyWalletAttestationJwtOptions, type BaseWalletAttestationOptions, type CertificateChain, ClientAttestationError, type ClientAttestationOptions, type ClientAuthenticationCallback, type ClientAuthenticationCallbackOptions, type ClientAuthenticationWalletAttestationJwtOptions, type CreateAccessTokenResponseOptions, type CreateClientAttestationPopJwtOptions, type CreateClientAttestationPopJwtOptionsForVersion, type CreateClientAttestationPopJwtOptionsV1_0, type CreateClientAttestationPopJwtOptionsV1_3, type CreateClientAttestationPopJwtOptionsV1_4, type CreateJarRequestOptions, type CreateJarRequestResult, type CreateMrtdValidationJwtOptions, type CreatePkceOptions, type CreatePkceReturn, type CreatePushedAuthorizationRequestOptions, type CreatePushedAuthorizationRequestOptionsV1_0, type CreatePushedAuthorizationRequestOptionsV1_3, type CreatePushedAuthorizationRequestOptionsV1_4, CreateTokenDPoPError, type CreateTokenDPoPOptions, CreateTokenResponseError, type DecodeJwtHeaderOptions, type DecodeJwtHeaderResult, type DecodeJwtOptions, type DecodeJwtResult, type DpopJwtHeader, type DpopJwtPayload, type FetchMrtdPopInitOptions, type FetchMrtdPopInitResult, type FetchMrtdPopVerifyOptions, type FetchMrtdPopVerifyResult, FetchTokenResponseError, type FetchTokenResponseOptions, type GetJwtFromFormPostOptions, IT_WALLET_CLIENT_ATTESTATION_POP_ALLOWED_ALG_VALUES, type InferSchemaOrDefaultOutput, type IsClientAttestationSupportedOptions, type ItWalletClientAttestationPopJwtAlg, type ItWalletClientAttestationPopJwtHeader, type ItWalletClientAttestationPopJwtPayload, type JarAuthorizationRequest, type JarRequestObjectHeader, type JarRequestObjectPayload, type Jwk, type JwkSet, type JwtHeader, type JwtPayload, type JwtSignerCustom, type JwtSignerDid, type JwtSignerFederation, type JwtSignerWithJwk, type JwtSignerX5c, MAX_JTI_LENGTH, type MrtdChallengeJwtHeader, type MrtdChallengeJwtPayload, type MrtdDocumentData, MrtdPopError, type MrtdPopInitResponseJwtHeader, type MrtdPopInitResponseJwtPayload, type MrtdPopVerifyResponse, type MrtdValidationJwtHeader, type MrtdValidationJwtPayload, Oauth2Error, type ParseAccessTokenRequestOptions, type ParseAccessTokenRequestResult, type ParseAuthorizationRequestOptions, type ParseAuthorizationRequestResult, type ParseMrtdChallengeOptions, type ParseMrtdChallengeResult, type ParsePushedAuthorizationRequestOptions, type ParsePushedAuthorizationRequestResult, type ParsedAccessTokenAuthorizationCodeRequestGrant, type ParsedAccessTokenRefreshTokenRequestGrant, type ParsedJarRequest, type ParsedJarRequestOptions, PkceCodeChallengeMethod, type PushedAuthorizationRequest, PushedAuthorizationRequestError, type PushedAuthorizationRequestSigned, type PushedAuthorizationRequestUnsignedV1_0, type PushedAuthorizationRequestUnsignedV1_3, type PushedAuthorizationResponse, type RefreshTokenGrantIdentifier, type RefreshTokenGrantType, type RequestLike, type RetrieveAuthorizationCodeAccessTokenOptions, SupportedClientAuthenticationMethod, type TrustChain, type VerifiedClientAttestationPopJwt, type VerifiedJarRequest, type VerifiedWalletAttestationJwt, type VerifiedWalletAttestationJwtV1_0, type VerifiedWalletAttestationJwtV1_3, type VerifiedWalletAttestationJwtV1_4, type VerifyAccessTokenRequestDpop, type VerifyAccessTokenRequestOptions, type VerifyAccessTokenRequestPkce, type VerifyAccessTokenRequestResult, type VerifyAuthorizationRequestDPoP, type VerifyAuthorizationRequestOptions, type VerifyAuthorizationRequestResult, type VerifyClientAttestationOptions, type VerifyClientAttestationPopJwtOptions, type VerifyJarRequestOptions, type VerifyMrtdChallengeOptions, type VerifyMrtdChallengeResult, type VerifyPkceOptions, type VerifyPushedAuthorizationRequestOptions, type VerifyPushedAuthorizationRequestReturn, type VerifyTokenDPoPOptions, type VerifyWalletAttestationJwtOptions, type VerifyWalletAttestationJwtOptionsV1_0, type VerifyWalletAttestationJwtOptionsV1_3, type VerifyWalletAttestationJwtOptionsV1_4, type WalletAttestationJwtV1_0, type WalletAttestationJwtV1_3, type WalletAttestationJwtV1_4, type WalletAttestationOptionsV1_0, type WalletAttestationOptionsV1_3, type WalletAttestationOptionsV1_4, authorizationCodeGrantIdentifier, clientAuthenticationAnonymous, clientAuthenticationWalletAttestationJwt, createAccessTokenResponse, createClientAttestationPopJwt, createJarRequest, createMrtdValidationJwt, createPkce, createPushedAuthorizationRequest, createTokenDPoP, createTokenRequest, createWalletAttestationJwt$2 as createWalletAttestationJwtV1_0, createWalletAttestationJwt$1 as createWalletAttestationJwtV1_3, createWalletAttestationJwt as createWalletAttestationJwtV1_4, decodeJwt, decodeJwtHeader, extractClientAttestationJwtsFromHeaders, extractDpopJwtFromHeaders, fetchJarRequestObject, fetchMrtdPopInit, fetchMrtdPopVerify, fetchPushedAuthorizationResponse, type fetchPushedAuthorizationResponseOptions, fetchTokenResponse, getJwtFromFormPost, htuFromRequestUrl, isClientAttestationSupported, isJarAuthorizationRequest, isPushedAuthorizationRequestSigned, isPushedAuthorizationRequestUnsigned, jwtAuthorizationRequestJwtHeaderTyp, jwtHeaderFromJwtSigner, oauthClientAttestationHeader, oauthClientAttestationPopHeader, parseAccessTokenRequest, parseAuthorizationRequest, parseJarRequest, parseMrtdChallenge, parsePushedAuthorizationRequest, refreshTokenGrantIdentifier, signedAuthorizationRequestJwtHeaderTyp, toURLSearchParams, validateJarRequestParams, verifyAccessTokenRequest, verifyAuthorizationRequest, verifyClientAttestation, verifyClientAttestationPopJwt, verifyJarRequest, verifyMrtdChallenge, verifyPkce, verifyPushedAuthorizationRequest, verifyTokenDPoP, verifyWalletAttestationJwt, verifyWalletAttestationJwt$3 as verifyWalletAttestationJwtV1_0, verifyWalletAttestationJwt$2 as verifyWalletAttestationJwtV1_3, verifyWalletAttestationJwt$1 as verifyWalletAttestationJwtV1_4, zAccessTokenProfileJwtHeader, zAccessTokenProfileJwtPayload, zAccessTokenRequest, zAccessTokenResponse, zAlgValueNotNone, zAuthorizationCodeGrantIdentifier, zAuthorizationRequestV1_0, zAuthorizationRequestV1_3, zCertificateChain, zCompactJwe, zCompactJwt, zDpopJwtHeader, zDpopJwtPayload, zItWalletClientAttestationPopJwtAlg, zItWalletClientAttestationPopJwtHeader, zItWalletClientAttestationPopJwtPayload, zItWalletClientAttestationPopJwtTyp, zJarAuthorizationRequest, zJarRequestObjectHeader, zJarRequestObjectPayload, zJwk, zJwkSet, zJwtConfirmationPayload, zJwtHeader, zJwtPayload, zMrtdChallengeJwtHeader, zMrtdChallengeJwtPayload, zMrtdPopInitResponseJwtHeader, zMrtdPopInitResponseJwtPayload, zMrtdPopVerifyResponse, zMrtdValidationJwtHeader, zMrtdValidationJwtPayload, zOauthClientAttestationHeader, zOauthClientAttestationPopHeader, zPushedAuthorizationRequestSigned, zPushedAuthorizationRequestUnsignedV1_0, zPushedAuthorizationRequestUnsignedV1_3, zPushedAuthorizationResponse, zRefreshTokenGrantIdentifier, zSignedAuthorizationRequestJwtHeaderTyp, zTrustChain, zWalletAttestationJwtHeaderV1_0, zWalletAttestationJwtHeaderV1_3, zWalletAttestationJwtHeaderV1_4, zWalletAttestationJwtPayloadV1_0, zWalletAttestationJwtPayloadV1_3, zWalletAttestationJwtPayloadV1_4, zWalletAttestationJwtV1_0, zWalletAttestationJwtV1_3, zWalletAttestationJwtV1_4 };