import { type JWTPayload } from 'jose';
/** URL-safe base64 of raw bytes (no padding). Portable (no Buffer), so it runs at the edge too. */
export declare function base64url(bytes: Uint8Array): string;
/** A random URL-safe token (default 32 bytes) for state / nonce / PKCE verifier / session ids. */
export declare function randomToken(bytes?: number): string;
/** PKCE S256 code challenge for a verifier. */
export declare function codeChallenge(verifier: string): Promise<string>;
export interface OidcMetadata {
    issuer: string;
    authorization_endpoint: string;
    token_endpoint: string;
    jwks_uri: string;
    end_session_endpoint?: string;
    revocation_endpoint?: string;
}
export interface TokenResult {
    accessToken: string;
    refreshToken?: string;
    idToken?: string;
    expiresIn: number;
}
export declare class BffTokenError extends Error {
}
/**
 * The two trust-anchor checks on a discovery document, before anything in it is believed.
 *
 * The document is the trust anchor for the whole connection: `issuer` becomes the `issuer` option passed to
 * `jwtVerify`, and `jwks_uri` supplies the keys that verification uses. Both halves of that comparison came
 * from the same document, so anyone able to answer the metadata URL could mint an id_token for any `sub` and
 * be issued a BFF session for that user. `requireHttps` in the .NET twin — and nothing at all here — bounded
 * only the metadata address.
 *
 * 1. **Issuer binding (OIDC Discovery §4.3).** The declared `issuer` MUST equal the authority the document was
 *    fetched from. This is the check that closes the bypass, and it holds whatever the scheme is.
 * 2. **No endpoint weaker than the authority.** For an https authority, every endpoint the document names must
 *    be https. An http authority is left alone on purpose: reaching an identity server on a private address is
 *    a supported topology, and that deployment has already accepted plaintext — what it has not accepted is
 *    being downgraded by a value the document chose.
 *
 * Mirrors `BffOidcConfig.Validate` in the .NET package. Exported so the check is testable on its own.
 */
export declare function assertTrustedMetadata(authority: string, m: OidcMetadata): void;
/** Talks to one tenant's OIDC endpoints: discovery + JWKS (cached, rotation-aware via jose), token exchange,
 * refresh, revocation, and id_token / logout_token verification. Bound to an authority only — the confidential
 * client credentials (and the expected audience) are passed per call, so a single-authority instance serves
 * whichever client a multi-tenant BFF resolves for it. Mirrors the .NET `BffOidcConfig` + `AuthagonalTokenClient`
 * split. Cache one per authority via {@link oidcClientCache}. */
export declare class OidcClient {
    private readonly authority;
    private metadata?;
    private jwks?;
    private fetchedAt;
    private static readonly TTL_MS;
    constructor(authority: string);
    private meta;
    authorizationEndpoint(): Promise<string>;
    endSessionEndpoint(): Promise<string | undefined>;
    exchangeCode(clientId: string, clientSecret: string, code: string, redirectUri: string, codeVerifier: string): Promise<TokenResult>;
    refresh(clientId: string, clientSecret: string, refreshToken: string): Promise<TokenResult>;
    revoke(clientId: string, clientSecret: string, refreshToken: string): Promise<void>;
    private postToken;
    verifyIdToken(idToken: string, clientId: string): Promise<JWTPayload>;
    /** Verify an OIDC back-channel logout token. Logout tokens carry no `exp`; jwtVerify only enforces `exp`
     * when present, so this validates signature + issuer + audience. Caller checks `events` / no-`nonce`. */
    /**
     * Verifies a back-channel Logout Token.
     *
     * A Logout Token carries no `exp` (OIDC Back-Channel Logout 1.0 §2.4 forbids relying on one), so
     * signature + issuer + audience alone made a captured token valid FOREVER: anyone who obtained one
     * could log the user out at will, indefinitely. The .NET BFF has bounded `iat` since 0.20.0; this
     * implementation did not, so a TypeScript host had a permanent denial-of-service primitive against
     * every session it had ever ended.
     */
    verifyLogoutToken(logoutToken: string, clientId: string): Promise<JWTPayload>;
}
/** Returns a memoized {@link OidcClient} per authority, so a multi-tenant BFF discovers each tenant's auth host
 * once and reuses its cached metadata + JWKS. Mirrors the .NET `BffOidcConfig` per-authority dictionary. */
export declare function oidcClientCache(): (authority: string) => OidcClient;