/**
 * @module
 *
 * Implements the `private_key_jwt` client authentication method, where the
 * client authenticates using a JWT signed with its private key (asymmetric cryptography).
 * The JWT is sent as a `client_assertion` in the request body, and the server
 * verifies it using the corresponding public key.
 *
 * JWT decoding and verification logic is injected via the constructor to avoid
 * a hard dependency on any particular JWT library.
 *
 * @see https://datatracker.ietf.org/doc/html/rfc7523
 * @see https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication
 */
import { OAuth2Client } from "../types.js";
import { ClientAssertionJwtVerify, JwtDecode, JwtPayload } from "../utils/jwt_types.js";
import { ClientAuthMethod, ClientAuthMethodResponse } from "./types.js";
/**
 * Asymmetric signing algorithms supported by the `private_key_jwt` authentication method.
 *
 * @see https://datatracker.ietf.org/doc/html/rfc7518#section-3
 */
export declare enum PrivateKeyJwtAlgorithms {
    /** RSASSA-PKCS1-v1_5 using SHA-256. */
    RS256 = "RS256",
    /** RSASSA-PKCS1-v1_5 using SHA-384. */
    RS384 = "RS384",
    /** RSASSA-PKCS1-v1_5 using SHA-512. */
    RS512 = "RS512",
    /** RSASSA-PSS using SHA-256. */
    PS256 = "PS256",
    /** RSASSA-PSS using SHA-384. */
    PS384 = "PS384",
    /** RSASSA-PSS using SHA-512. */
    PS512 = "PS512",
    /** ECDSA using P-256 and SHA-256. */
    ES256 = "ES256",
    /** ECDSA using P-384 and SHA-384. */
    ES384 = "ES384",
    /** ECDSA using P-521 and SHA-512. */
    ES512 = "ES512",
    /** Edwards-curve Digital Signature Algorithm (Ed25519 / Ed448). */
    EdDSA = "EdDSA"
}
/**
 * {@link ClientAuthMethod} implementation for the `private_key_jwt` authentication method.
 *
 * The client creates a JWT signed with its private key and sends it as a
 * `client_assertion` parameter in the token request body. The server decodes the
 * assertion to identify the client, then retrieves the client's public key via the
 * {@link PrivateKeyJwt.getPublicKeyForClient} handler to verify the signature.
 *
 * @see https://datatracker.ietf.org/doc/html/rfc7523
 */
export declare class PrivateKeyJwt implements ClientAuthMethod {
    #private;
    /**
     * Convenience reference to the {@link PrivateKeyJwtAlgorithms} enum,
     * allowing callers to reference algorithms without a separate import.
     *
     * @example
     * ```ts
     * jwt.addAlgorithm(PrivateKeyJwt.algo.ES256);
     * ```
     */
    static algo: typeof PrivateKeyJwtAlgorithms;
    /**
     * The identifier for this authentication method.
     * Always `"private_key_jwt"`.
     */
    get method(): "private_key_jwt";
    /**
     * Whether the client secret is optional for this method.
     * Always `false` - a public key is required to verify the JWT assertion.
     */
    get secretIsOptional(): boolean;
    /**
     * The list of accepted asymmetric signing algorithms.
     * Defaults to `[RS256]` if no algorithms have been added via {@link PrivateKeyJwt.addAlgorithm}.
     */
    get algorithms(): PrivateKeyJwtAlgorithms[];
    /**
     * Creates a new `PrivateKeyJwt` instance.
     *
     * @param jwtDecode - A function that decodes a JWT without verifying its signature,
     *   used to extract the `aud` claim to identify the client before looking up its public key.
     * @param jwtVerify - A function that verifies a JWT using an asymmetric public key.
     */
    constructor(jwtDecode: JwtDecode, jwtVerify: ClientAssertionJwtVerify);
    /**
     * Adds an asymmetric signing algorithm to the list of accepted algorithms.
     * Duplicate entries are ignored. The list is kept sorted.
     *
     * @param algo - The algorithm to accept.
     */
    addAlgorithm(algo: PrivateKeyJwtAlgorithms): this;
    /**
     * Registers the handler used to retrieve the client's public key for JWT signature verification.
     *
     * The handler receives the client ID (from the `aud` claim), the decoded JWT payload,
     * and the raw client assertion string. It should return the client's public key as a
     * `Uint8Array` or PEM string, or `null` if the client is not found.
     *
     * @param handler - An async function that returns the public key or `null`.
     */
    getPublicKeyForClient(handler: (clientId: string, decoded: JwtPayload, clientAssertion: string, clientData?: Partial<OAuth2Client> | undefined) => Promise<object | null>): this;
    /**
     * Optionally retrieves the client information based on the decoded JWT and client assertion.
     *
     * Particularly useful when the client information is needed for further processing after JWT verification.
     *
     * @param handler - An async function that returns the client information or `undefined`.
     * @returns The current `PrivateKeyJwt` instance for chaining.
     */
    getClientData(handler: (clientId: string, decoded: JwtPayload, clientAssertion: string) => Promise<Partial<OAuth2Client> | undefined> | Partial<OAuth2Client> | undefined): this;
    /**
     * Extracts and verifies the client assertion JWT from the request body.
     *
     * Looks for `client_assertion_type` set to
     * `"urn:ietf:params:oauth:client-assertion-type:jwt-bearer"` and a
     * `client_assertion` JWT string. The `aud` claim is used as the `client_id`.
     * The JWT signature is verified using the public key returned by the
     * {@link PrivateKeyJwt.getPublicKeyForClient} handler. On success, the raw
     * `client_assertion` string is stored as `clientSecret` to satisfy the
     * {@link ClientAuthMethodResponse} contract.
     *
     * Supports `application/x-www-form-urlencoded` and `application/json` content types.
     *
     * @param req - The incoming HTTP request.
     * @returns The extracted client credentials, or `{ hasAuthMethod: false }` if the
     *   request does not contain a valid JWT client assertion.
     */
    extractClientCredentials(req: Request): Promise<ClientAuthMethodResponse>;
}
//# sourceMappingURL=private_key_jwt.d.ts.map