export interface ClaimGrantChain {
    type: string;
    handle: (params: Record<string, string>) => Promise<Response> | Response;
}
export interface OAuthProxyPaths {
    authorize?: string;
    register?: string;
    callback?: string;
}
export interface OAuthProxyOptions {
    /** Absolute base URL for the AuthKit redirect_uri + advertised endpoints.
     *  String, per-request resolver, or omitted to derive from forwarded headers. */
    baseUrl?: string | ((request: Request) => string);
    /** WorkOS client id. Defaults to process.env.WORKOS_CLIENT_ID. */
    workosClientId?: string;
    /** HS256 key for the proxy's refresh tokens. Defaults to
     *  process.env.REFRESH_TOKEN_SECRET. No fallback — see the note above. */
    refreshSecret?: string;
    paths?: OAuthProxyPaths;
    /** Seconds/ms overrides. accessTokenTtl is what we *advertise* for the WorkOS
     *  access token; refreshTtl is how long our wrapper JWT stays valid. */
    ttl?: {
        clientMs?: number;
        sessionMs?: number;
        codeMs?: number;
        accessTokenSeconds?: number;
        refreshSeconds?: number;
    };
    /** Chain another grant type through the same /oauth/token route — e.g.
     *  auth.md's claim grant, so one route serves both. Pass a function when the
     *  handler isn't available yet at construction (createBilling builds the proxy
     *  first, because agent-auth needs its endpoints for discovery). */
    claimGrant?: ClaimGrantChain | (() => ClaimGrantChain | undefined);
}
export declare function createOAuthProxy(opts?: OAuthProxyOptions): {
    register: (request: Request) => Promise<Response>;
    authorize: (request: Request) => Promise<Response>;
    callback: (request: Request) => Promise<Response>;
    token: (request: Request) => Promise<Response>;
    /** Grant types to advertise in AS metadata. */
    grantTypes: readonly ["authorization_code", "refresh_token"];
    /** AS-metadata fields this proxy adds — merge into the discovery document so
     *  the endpoints are only advertised where they actually exist. */
    asMetadata: (request: Request) => {
        authorization_endpoint: string;
        registration_endpoint: string;
    };
    paths: Required<OAuthProxyPaths>;
};
export type OAuthProxy = ReturnType<typeof createOAuthProxy>;
//# sourceMappingURL=index.d.ts.map