import * as hono from 'hono';
import { Env, Context } from 'hono';
import { D as DPoPNonceStore, N as NonceProvider } from './types-CuViAwD5.js';
export { D1DatabaseLike, D1PreparedStatementLike, D1StoreOptions } from './stores/cloudflare-d1.js';
export { KVNamespaceLike, KVStoreOptions } from './stores/cloudflare-kv.js';
export { DurableObjectStorageLike, DurableObjectStoreOptions } from './stores/durable-objects.js';
export { MemoryNonceStore, MemoryNonceStoreOptions } from './stores/memory.js';
export { RedisClientLike, RedisStoreOptions } from './stores/redis.js';

type DPoPErrorCode = "INVALID_DPOP_PROOF" | "MISSING_ACCESS_TOKEN" | "ATH_MISMATCH" | "JTI_REPLAY" | "USE_NONCE";
interface ProblemDetail {
    type: string;
    title: string;
    status: number;
    detail: string;
    code: DPoPErrorCode;
    /** Value for the `error` parameter of the WWW-Authenticate: DPoP header (RFC 9449 §7.1). */
    wwwAuthError: string;
    /** Extra parameters merged into the WWW-Authenticate header (e.g., `nonce`, `algs`). */
    wwwAuthExtras?: Record<string, string>;
    /** Extra response headers to set on the error response (e.g., `DPoP-Nonce`). */
    additionalHeaders?: Record<string, string>;
}
/** Clamp HTTP status to 200-599 integer range; returns 500 for out-of-range or non-integer values. */
declare function clampHttpStatus(status: number): number;
/** Build an `WWW-Authenticate: DPoP error="...", key="value", ...` header value. */
declare function wwwAuthenticateHeader(wwwAuthError: string, extras?: Record<string, string>): string;
interface ProblemResponseExtras {
    wwwAuthExtras?: Record<string, string>;
    extraHeaders?: Record<string, string>;
}
declare function problemResponse(problem: ProblemDetail, extras?: ProblemResponseExtras): Response;
/** Thrown by verification helpers; carries the ProblemDetail that should be sent to the client. */
declare class DPoPProofError extends Error {
    readonly problem: ProblemDetail;
    constructor(problem: ProblemDetail);
}
declare const DPoPErrors: {
    readonly invalidProof: (detail: string) => ProblemDetail;
    readonly missingAccessToken: () => ProblemDetail;
    readonly athMismatch: () => ProblemDetail;
    readonly jtiReplay: () => ProblemDetail;
    readonly useNonce: (freshNonce: string) => ProblemDetail;
};

interface AccessTokenClaimsWithCnf {
    cnf?: {
        jkt?: string;
    };
}
/**
 * Returns true when the access token's `cnf.jkt` claim equals the proof
 * thumbprint exposed on `c.get("dpop").jkt`. Returns false on missing or
 * mismatched binding.
 *
 * Use this for explicit branching in route handlers. For the throwing
 * variant that integrates with the standard 401 + WWW-Authenticate
 * pipeline, see `assertJktBinding`.
 */
declare function verifyJktBinding(accessTokenClaims: AccessTokenClaimsWithCnf, proofThumbprint: string): boolean;
/**
 * Throws `DPoPProofError` (formatted as 401 + `WWW-Authenticate: DPoP error="invalid_dpop_proof"`)
 * when the access token's `cnf.jkt` does not match the proof thumbprint, or when
 * `cnf.jkt` is missing entirely.
 *
 * Typical usage inside a route handler:
 * ```ts
 * const proof = c.get("dpop")!;
 * const claims = await verifyMyJwt(token);
 * assertJktBinding(claims, proof.jkt);
 * ```
 */
declare function assertJktBinding(accessTokenClaims: AccessTokenClaimsWithCnf, proofThumbprint: string): void;

type JwsAlgorithm = "ES256" | "ES384" | "ES512" | "RS256" | "RS384" | "RS512" | "PS256" | "PS384" | "PS512" | "EdDSA" | "Ed25519";
declare const SUPPORTED_ALGORITHMS: readonly ["ES256", "ES384", "ES512", "RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "EdDSA", "Ed25519"];
interface EcPublicJwk {
    kty: "EC";
    crv: "P-256" | "P-384" | "P-521";
    x: string;
    y: string;
    [k: string]: unknown;
}
interface RsaPublicJwk {
    kty: "RSA";
    n: string;
    e: string;
    [k: string]: unknown;
}
interface OkpPublicJwk {
    kty: "OKP";
    crv: "Ed25519";
    x: string;
    [k: string]: unknown;
}
type PublicJwk = EcPublicJwk | RsaPublicJwk | OkpPublicJwk;
declare function assertPublicJwk(jwk: unknown): asserts jwk is PublicJwk;
/**
 * RFC 7638 JWK Thumbprint: canonical JSON of required members in lex order,
 * SHA-256, base64url (no padding).
 */
declare function jwkThumbprint(jwk: PublicJwk): Promise<string>;

interface DPoPVerifiedProof {
    /** RFC 7638 SHA-256 JWK thumbprint of the proof's public key (base64url, no padding). */
    jkt: string;
    jti: string;
    jwk: PublicJwk;
    htm: string;
    /** Normalized URL (query and fragment stripped). */
    htu: string;
    iat: number;
    ath?: string;
    /** Raw `DPoP` header value. */
    raw: string;
}
interface DPoPEnv extends Env {
    Variables: {
        dpop: DPoPVerifiedProof | undefined;
    };
}
interface DPoPOptions {
    nonceStore: DPoPNonceStore;
    algorithms?: readonly JwsAlgorithm[];
    /** Allowed clock skew on `iat` in seconds (default: 60). */
    iatTolerance?: number;
    /** How long a `jti` is remembered, in milliseconds (default: 5 minutes). */
    jtiTtl?: number;
    /**
     * Override request URL extraction. Default: `c.req.url`.
     * Use this when behind a reverse proxy that rewrites the host or scheme.
     */
    getRequestUrl?: (c: Context) => string | Promise<string>;
    /**
     * Override access-token extraction. Default: parses `Authorization: DPoP <token>`.
     * Returning `undefined` means no access token is present (skip ath verification).
     */
    getAccessToken?: (c: Context) => string | undefined | Promise<string | undefined>;
    /** Reject with 401 when access token is missing (default: false). */
    requireAccessToken?: boolean;
    /** Custom error response. Default: RFC 9457 Problem Details + RFC 9449 WWW-Authenticate. */
    onError?: (error: ProblemDetail, c: Context) => Response | Promise<Response>;
    /**
     * Server-issued nonce provider (RFC 9449 §8). When set, proofs missing or with
     * an invalid `nonce` claim are rejected with `error="use_dpop_nonce"` and a
     * fresh nonce in the `DPoP-Nonce` header. Successful responses also carry the
     * current nonce.
     */
    nonceProvider?: NonceProvider;
    /** Maximum byte length of the `DPoP` header (default: 8192). */
    maxProofSize?: number;
    /** Maximum byte length of the access token (default: 4096). */
    maxAccessTokenSize?: number;
    /** Override clock — function returning milliseconds epoch. Default: `Date.now`. */
    clock?: () => number;
    /**
     * `htu` comparison policy. `"strict"` (default) requires byte-equality after
     * URL normalization. `"trailing-slash-insensitive"` strips trailing `/` from
     * paths (except root) before comparison.
     */
    htuComparison?: "strict" | "trailing-slash-insensitive";
    /**
     * Allow proofs whose `iat` is in the future. Default: `false` (symmetric window).
     * When true, only past staleness is rejected: `iat < now - iatTolerance`.
     */
    allowFutureIat?: boolean;
}

declare function dpop(options: DPoPOptions): hono.MiddlewareHandler<DPoPEnv, string, {}, Response>;

interface MemoryNonceProviderOptions {
    /** Rotate the nonce after this many milliseconds (default: 5 minutes). */
    rotateAfter?: number;
    /** Accept the previous nonce in addition to the current one (default: true). */
    retainPrevious?: boolean;
    /** Override clock — function returning milliseconds epoch. Default: `Date.now`. */
    clock?: () => number;
}
/**
 * In-process server nonce provider per RFC 9449 §8. Generates a UUID nonce that
 * rotates every `rotateAfter` milliseconds. By default, the previous nonce is also
 * accepted to absorb the natural race between rotation and an in-flight client request.
 *
 * Stateful and process-local — for multi-instance deployments, implement `NonceProvider`
 * against a shared store (Redis, Cloudflare KV, etc.).
 */
declare function memoryNonceProvider(options?: MemoryNonceProviderOptions): NonceProvider;

export { type AccessTokenClaimsWithCnf, type DPoPEnv, type DPoPErrorCode, DPoPErrors, DPoPNonceStore, type DPoPOptions, DPoPProofError, type DPoPVerifiedProof, type EcPublicJwk, type JwsAlgorithm, type MemoryNonceProviderOptions, NonceProvider, type OkpPublicJwk, type ProblemDetail, type ProblemResponseExtras, type PublicJwk, type RsaPublicJwk, SUPPORTED_ALGORITHMS, assertJktBinding, assertPublicJwk, clampHttpStatus, dpop, jwkThumbprint, memoryNonceProvider, problemResponse, verifyJktBinding, wwwAuthenticateHeader };