import * as v from 'valibot';
import type { JoseContext } from '@protokoll/jose';
import type { MaybePromise, PickDeep } from '@protokoll/core';
import type { JarmAuthResponse, JarmAuthResponseEncrypted } from '../index.js';
import type { OAuthAuthRequestGetParamsOut } from '../v-auth-request.js';
export declare namespace JarmAuthResponseEncryptedHandle {
    const vInput: v.ObjectSchema<{
        /**
         * The JARM response parameter conveyed either as url query param, fragment param, or application/x-www-form-urlencoded in the body of a post request
         */
        readonly response: v.StringSchema<undefined>;
    }, undefined>;
    type Input = v.InferOutput<typeof vInput>;
    const vOut: v.ObjectSchema<{
        readonly authRequest: v.LooseObjectSchema<{
            readonly state: v.OptionalSchema<v.StringSchema<undefined>, never>;
            readonly response_mode: v.OptionalSchema<v.UnionSchema<[v.PicklistSchema<["jwt", "query.jwt", "fragment.jwt", "form_post.jwt"], undefined>, v.PicklistSchema<["direct_post.jwt"], undefined>], undefined>, never>;
            readonly client_id: v.StringSchema<undefined>;
            readonly response_type: v.SchemaWithPipe<[v.StringSchema<undefined>, v.TransformAction<string, string>, v.PicklistSchema<["vp_token", "id_token vp_token", "code", "token", "none", "id_token", "code token", "code id_token", "id_token token", "code id_token token"], undefined>]>;
            readonly client_metadata: v.OptionalSchema<v.LooseObjectSchema<{
                readonly jwks: v.OptionalSchema<v.ObjectSchema<{
                    readonly keys: v.ArraySchema<v.LooseObjectSchema<{
                        readonly kid: v.OptionalSchema<v.StringSchema<undefined>, never>;
                        readonly kty: v.StringSchema<undefined>;
                    }, undefined>, undefined>;
                }, undefined>, never>;
                readonly jwks_uri: v.OptionalSchema<v.StringSchema<undefined>, never>;
            }, undefined>, never>;
        }, undefined>;
        readonly authResponse: v.LooseObjectSchema<{
            readonly vp_token: v.UnionSchema<[v.StringSchema<undefined>, v.ArraySchema<v.StringSchema<undefined>, undefined>], undefined>;
            readonly presentation_submission: v.UnknownSchema;
            readonly nonce: v.OptionalSchema<v.StringSchema<undefined>, never>;
            readonly iss: v.OptionalSchema<v.NonOptionalSchema<v.SchemaWithPipe<[v.OptionalSchema<v.StringSchema<undefined>, never>, v.DescriptionAction<string | undefined, "JWT Issuer {@see @link https://www.rfc-editor.org/rfc/rfc7519#section-4.1.1 RFC7519#section-4.1.1}">]>, undefined>, never>;
            readonly aud: v.OptionalSchema<v.NonOptionalSchema<v.SchemaWithPipe<[v.OptionalSchema<v.UnionSchema<[v.StringSchema<undefined>, v.ArraySchema<v.StringSchema<undefined>, undefined>], undefined>, never>, v.DescriptionAction<string | string[] | undefined, "JWT Audience {@see @link https://www.rfc-editor.org/rfc/rfc7519#section-4.1.3 RFC7519#section-4.1.3}">]>, undefined>, never>;
            readonly exp: v.OptionalSchema<v.NonOptionalSchema<v.SchemaWithPipe<[v.OptionalSchema<v.NumberSchema<undefined>, never>, v.DescriptionAction<number | undefined, "JWT Expiration Time {@see @link https://www.rfc-editor.org/rfc/rfc7519#section-4.1.4 RFC7519#section-4.1.4}">]>, undefined>, never>;
            readonly state: v.OptionalSchema<v.StringSchema<undefined>, never>;
            readonly sub: v.SchemaWithPipe<[v.OptionalSchema<v.StringSchema<undefined>, never>, v.DescriptionAction<string | undefined, "JWT Subject {@see @link https://www.rfc-editor.org/rfc/rfc7519#section-4.1.2 RFC7519#section-4.1.2}">]>;
            readonly jti: v.SchemaWithPipe<[v.OptionalSchema<v.StringSchema<undefined>, never>, v.DescriptionAction<string | undefined, "JWT ID {@see @link https://www.rfc-editor.org/rfc/rfc7519#section-4.1.7 RFC7519#section-4.1.7}">]>;
            readonly nbf: v.SchemaWithPipe<[v.OptionalSchema<v.NumberSchema<undefined>, never>, v.DescriptionAction<number | undefined, "JWT Not Before {@see @link https://www.rfc-editor.org/rfc/rfc7519#section-4.1.5 RFC7519#section-4.1.5}">]>;
            readonly iat: v.SchemaWithPipe<[v.OptionalSchema<v.NumberSchema<undefined>, never>, v.DescriptionAction<number | undefined, "JWT Issued At {@see @link https://www.rfc-editor.org/rfc/rfc7519#section-4.1.6 RFC7519#section-4.1.6}">]>;
        }, undefined>;
        readonly type: v.PicklistSchema<["signed encrypted", "encrypted", "signed"], undefined>;
    }, undefined>;
    type Out = v.InferOutput<typeof vOut>;
    interface Context extends PickDeep<JoseContext, 'jose.jwe.decryptCompact' | 'jose.jws.verifyJwt'> {
        openid4vp: {
            authRequest: {
                get: (input: JarmAuthResponse | JarmAuthResponseEncrypted) => MaybePromise<OAuthAuthRequestGetParamsOut>;
            };
        };
    }
}
/**
 * Validate a JARM direct_post.jwt compliant authentication response
 * * The decryption key should be resolvable using the the protected header's 'kid' field
 * * The signature verification jwk should be resolvable using the jws protected header's 'kid' field and the payload's 'iss' field.
 */
export declare const jarmAuthResponseEncryptedHandle: (input: JarmAuthResponseEncryptedHandle.Input, ctx: JarmAuthResponseEncryptedHandle.Context) => Promise<JarmAuthResponseEncryptedHandle.Out>;
//# sourceMappingURL=jarm-auth-response-encrypted.d.ts.map