export interface RemoteAsConfig {
    issuer: string;
    jwksUri?: string;
    audience: string;
}
export interface RemoteAccessGrant {
    kind: "access";
    subject: string;
    clientId: string;
    resource: string;
    scopes: string[];
    expiresAt: string;
}
/** Validates bearer JWTs issued by an external authorization server. The
 * RemoteJWKSet keeps verified keys in memory and re-fetches the JWKS when an
 * unfamiliar `kid` appears, which covers ordinary zero-downtime key rotation. */
export declare class RemoteAsVerifier {
    #private;
    constructor(config: RemoteAsConfig);
    authenticate(req: Request): Promise<{
        grant: RemoteAccessGrant;
        tokenWasPresented: true;
    } | null>;
}
//# sourceMappingURL=remote-as.d.ts.map