/**
 * JWT Assertion Builder for Private Key JWT Authentication (RFC 7523)
 *
 * Creates JWT assertions for client authentication at the token endpoint.
 * Requires client private keys for signing.
 */
/**
 * JWT Assertion Claims (RFC 7523 Section 3)
 */
export interface JWTAssertionClaims {
    /** Issuer - client_id */
    iss: string;
    /** Subject - client_id (must match iss) */
    sub: string;
    /** Audience - token endpoint URL */
    aud: string;
    /** Expiration time (Unix timestamp) */
    exp: number;
    /** JWT ID - unique identifier for this JWT */
    jti: string;
    /** Issued at time (Unix timestamp) - optional */
    iat?: number;
    /** Not before time (Unix timestamp) - optional */
    nbf?: number;
}
/**
 * JWT Header
 */
export interface JWTHeader {
    /** Algorithm - RS256, ES256, etc. */
    alg: string;
    /** Type - always "JWT" */
    typ: string;
    /** Key ID - identifies which key was used */
    kid?: string;
}
/**
 * Generate a JWT assertion for private_key_jwt authentication
 *
 * NOTE: This is a simplified implementation for testing purposes.
 * In production, use a proper JWT library like `jose` or `jsonwebtoken`.
 *
 * @param clientId - Client identifier (used for both iss and sub)
 * @param tokenEndpoint - Token endpoint URL (used for aud)
 * @param privateKey - Client private key (PEM format) - OPTIONAL for testing
 * @param kid - Key ID to include in header - OPTIONAL
 * @returns JWT assertion string
 */
export declare function generateJWTAssertion(clientId: string, tokenEndpoint: string, privateKey?: string, kid?: string): Promise<string>;
/**
 * Validate JWT assertion format (without signature verification)
 *
 * @param assertion - JWT assertion string
 * @returns Validation result with parsed claims
 */
export declare function validateJWTAssertionFormat(assertion: string): {
    valid: boolean;
    header?: JWTHeader;
    claims?: JWTAssertionClaims;
    errors: string[];
};
//# sourceMappingURL=jwt-assertion.d.ts.map