/**
 * Claims defined by RFC 9068: "JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens"
 * https://datatracker.ietf.org/doc/html/rfc9068
 *
 * These tokens are intended for consumption by resource servers.
 */
export type DecodedAccessToken_RFC9068 = {
    iss: string;
    sub: string;
    aud: string | string[];
    exp: number;
    iat: number;
    client_id?: string;
    scope?: string;
    jti?: string;
    nbf?: number;
    auth_time?: number;
    cnf?: Record<string, unknown>;
    [key: string]: unknown;
};
export type ValidateAndDecodeAccessToken<DecodedAccessToken> = (params: ValidateAndDecodeAccessToken.Params) => Promise<ValidateAndDecodeAccessToken.ReturnType<DecodedAccessToken>>;
export declare namespace ValidateAndDecodeAccessToken {
    type Params = Params.Bearer | Params.DPoP;
    namespace Params {
        type Common = {
            accessToken: string;
        };
        export type Bearer = Common & {
            scheme: "Bearer";
            rejectIfAccessTokenDPoPBound: boolean;
        };
        export type DPoP = Common & {
            scheme: "DPoP";
            dpopProof: string;
            expectedHtu: string | undefined;
            expectedHtm: string | undefined;
        };
        export {};
    }
    type ReturnType<DecodedAccessToken> = (ReturnType.Success<DecodedAccessToken> & {
        errorCause?: never;
        debugErrorMessage?: never;
    }) | (ReturnType.Errored & {
        decodedAccessToken?: never;
        decodedAccessToken_original?: never;
        accessToken?: never;
    });
    namespace ReturnType {
        type Success<DecodedAccessToken> = {
            isSuccess: true;
            decodedAccessToken: DecodedAccessToken;
            decodedAccessToken_original: DecodedAccessToken_RFC9068;
            accessToken: string;
        };
        type Errored = {
            isSuccess: false;
            errorCause: "validation error" | "validation error - access token expired" | "validation error - invalid signature";
            debugErrorMessage: string;
        };
    }
}
export type ParamsOfBootstrap<DecodedAccessToken> = ParamsOfBootstrap.Real | ParamsOfBootstrap.Mock<DecodedAccessToken>;
export declare namespace ParamsOfBootstrap {
    type Real = {
        implementation: "real";
        issuerUri: string;
        expectedAudience: string | undefined;
    };
    type Mock<DecodedAccessToken> = Mock.DecodeOnly | Mock.UseStaticIdentity<DecodedAccessToken>;
    namespace Mock {
        type Common = {
            implementation: "mock";
        };
        export type DecodeOnly = Common & {
            behavior: "decode only";
        };
        export type UseStaticIdentity<DecodedAccessToken> = Common & {
            behavior: "use static identity";
            decodedAccessToken_mock: DecodedAccessToken;
            decodedAccessToken_original_mock?: DecodedAccessToken_RFC9068;
            accessToken_mock?: string;
        };
        export {};
    }
}
export type OidcSpaUtils<DecodedAccessToken> = {
    bootstrapAuth: (params: ParamsOfBootstrap<DecodedAccessToken>) => Promise<void>;
    validateAndDecodeAccessToken: ValidateAndDecodeAccessToken<DecodedAccessToken>;
    ofTypeDecodedAccessToken: DecodedAccessToken;
};