import { JwkThumbprintCalculator, JwkVerify, JwtPayload } from "../utils/jwt_types.js";
import { ReplayDetector } from "../utils/replay_store.js";
import type { TokenType, TokenTypeValidationResponse } from "./types.js";
export interface DPoPTokenTypeValidationResponse extends TokenTypeValidationResponse {
    data?: {
        dpopPayload: Record<string, unknown>;
        dpopThumbprint?: string;
    };
}
/**
 * A custom handler for validating a DPoP-bound access token on a protected resource endpoint.
 *
 * @param request - The incoming HTTP request containing the `DPoP` proof header.
 * @param token - The DPoP-bound access token extracted from the `Authorization` header.
 * @param tokenLifetime - The maximum acceptable age of the DPoP proof in seconds.
 * @returns A validation response indicating whether the proof and token are valid.
 */
export type DPoPTokenTypeValidation = (request: Request, token: string, tokenLifetime: number) => DPoPTokenTypeValidationResponse | Promise<DPoPTokenTypeValidationResponse>;
/**
 * A custom handler for validating a DPoP proof on a token endpoint request,
 * before client credentials are checked.
 *
 * @param req - The incoming token endpoint HTTP request containing the `DPoP` proof header.
 * @param tokenLifetime - The maximum acceptable age of the DPoP proof in seconds.
 * @returns A validation response indicating whether the proof is valid.
 */
export type DPoPTokenTypeRequestValidation = (req: Request, tokenLifetime: number) => DPoPTokenTypeValidationResponse | Promise<DPoPTokenTypeValidationResponse>;
/**
 * {@link TokenType} implementation for the DPoP (Demonstration of Proof-of-Possession) token scheme.
 *
 * Validates DPoP proofs on both the token endpoint and protected resource endpoints,
 * and detects replayed JTI claims using a {@link ReplayDetector}.
 *
 * @see https://datatracker.ietf.org/doc/html/rfc9449
 */
export declare class DPoPTokenType implements TokenType {
    #private;
    /**
     * The token type prefix used in the `Authorization` header and `token_type` response field.
     * Always `"DPoP"`.
     */
    get prefix(): "DPoP";
    /**
     * Returns the DPoP-related metadata to include in the OpenID Connect discovery document.
     */
    get configuration(): {
        dpop_signing_alg_values_supported: string[];
        require_dpop: boolean;
    };
    /**
     * Creates a new `DPoPTokenType` instance.
     *
     * @param jwkVerify - A function that verifies a DPoP proof JWT against a JWK Set.
     * @param jwkThumbprintCalculator - A function that calculates the JWK thumbprint for a given JWK.
     * @param replayDetector - An optional replay detector for JTI tracking.
     *   Defaults to an {@link InMemoryReplayStore}.
     */
    constructor(jwkVerify: JwkVerify, jwkThumbprintCalculator: JwkThumbprintCalculator, replayDetector?: ReplayDetector);
    private _handleDefault;
    /**
     * Replaces the replay detector used for JTI tracking.
     * Use this to provide a distributed store (e.g. Redis) in multi-process deployments.
     *
     * @param value - The replay detector to use.
     */
    setReplayDetector(value: ReplayDetector): this;
    /**
     * Set the token lifetime for DPoP proofs (in seconds). Default is 300 seconds (5 minutes).
     * @param tokenLifetime - token lifetime for DPoP proofs (in seconds)
     */
    setTokenLifetime(tokenLifetime: number): this;
    /**
     * Overrides the default DPoP proof validation handler for token endpoint requests.
     *
     * @param handler - A custom {@link DPoPTokenTypeRequestValidation} function.
     */
    validateTokenRequest(handler: DPoPTokenTypeRequestValidation): this;
    /**
     * Overrides the default DPoP proof validation handler for protected resource requests.
     *
     * @param handler - A custom {@link DPoPTokenTypeValidation} function.
     */
    validate(handler: DPoPTokenTypeValidation): this;
    /**
     * Validates the DPoP proof on an incoming token endpoint request.
     * Called before client credentials are verified.
     *
     * @param req - The incoming token endpoint HTTP request.
     * @returns A validation response indicating whether the DPoP proof is valid.
     */
    isValidTokenRequest(req: Request): Promise<DPoPTokenTypeValidationResponse>;
    /**
     * Validates the DPoP proof on an incoming protected resource request.
     *
     * @param req - The incoming HTTP request.
     * @param token - The DPoP-bound access token extracted from the `Authorization` header.
     * @returns A validation response indicating whether the proof and token are valid.
     */
    isValid(req: Request, token: string): Promise<DPoPTokenTypeValidationResponse>;
    /**
     * Update the claims of a JWT payload to include the JWK thumbprint in the `cnf` claim.
     * Use this when issuing a DPoP-bound access token to bind it to the public key of the DPoP proof.
     *
     * @param claims - The JWT claims object to which the JWK thumbprint will be added.
     * @param thumbprint - The JWK thumbprint to add to the `cnf` claim.
     * @returns The updated JWT claims object.
     * @throws If the claims object is invalid or the thumbprint is not a non-empty string.
     */
    addJwkThumbprintToCnfClaim(claims: JwtPayload, thumbprint: string): JwtPayload;
    /**
     * Update the claims of a JWT payload to include the JWK thumbprint in the `cnf` claim.
     * Use this when issuing a DPoP-bound access token to bind it to the public key of the DPoP proof.
     *
     * @param claims - The JWT claims object to which the JWK thumbprint will be added.
     * @param response - The token type validation response containing the DPoP thumbprint.
     * @returns The updated JWT claims object.
     * @throws If the validation response is invalid or does not contain a DPoP thumbprint.
     */
    addJwkThumbprintToCnfClaim(claims: JwtPayload, response: TokenTypeValidationResponse): JwtPayload;
    /**
     * Validates the DPoP thumbprint in a token type validation response.
     *
     * @param response - The token type validation response to check.
     * @param thumbprint - The expected DPoP thumbprint.
     * @returns `true` if the response is valid and the thumbprint matches.
     * @throws If the response is invalid or the thumbprint does not match.
     */
    validateThumbprint(response: TokenTypeValidationResponse, thumbprint: string): response is DPoPTokenTypeValidationResponse & {
        isValid: true;
        data: {
            dpopThumbprint: string;
        };
    };
    /**
     * Validates the DPoP thumbprint in a token type validation response.
     *
     * @param response - The token type validation response to check.
     * @param payload - The JWT payload containing the JWK thumbprint in the `cnf` claim.
     * @returns `true` if the response is valid and the thumbprint matches.
     * @throws If the response is invalid or the thumbprint does not match.
     */
    validateThumbprint(response: TokenTypeValidationResponse, payload: JwtPayload): response is DPoPTokenTypeValidationResponse & {
        isValid: true;
        data: {
            dpopThumbprint: string;
        };
    };
    /**
     * Validates the access token hash (`ath`) in a token type validation response against the provided access token.
     * @param response - The token type validation response to check.
     * @param accessToken - The access token to validate against the DPoP proof.
     */
    validateAccessTokenHash(response: TokenTypeValidationResponse, accessToken: string): Promise<void>;
}
//# sourceMappingURL=dpop_token.d.ts.map