/**
 * @typedef {Object} OAuthConfig
 * @property {string} baseUrl                       app origin, e.g. `https://app.com`
 * @property {string} callback                      callback template, e.g. `/auth/{provider}/callback`
 * @property {SessionStore} [store]                 optional server-side session store (keyed by `state`)
 * @property {{ maxAuthAge?: string|number, clockTolerance?: string|number }} [security]
 * @property {ResolvedProvider[]} providers         provider descriptors from `./providers/*`
 *
 * @typedef {Object} SessionStore
 * @property {(key: string, value: string, ttlMs: number) => unknown} set
 * @property {(key: string) => (string | null | undefined) | Promise<string | null | undefined>} get
 * @property {(key: string) => unknown} delete
 *
 * @typedef {import('./providers/_base.js').ResolvedProvider} ResolvedProvider
 */
/**
 * @param {OAuthConfig} config
 */
export function createOAuth(config: OAuthConfig): {
    /**
     * Begin the flow. Returns the authorization `url` to redirect to and
     * an opaque `session` string to stash (cookie / store). When a store
     * is configured the session is also persisted keyed by `state`.
     *
     * @param {string} name
     * @param {{ scope?: string[], sessionBinding?: string, params?: Record<string,string> }} [options]
     */
    authorize(name: string, options?: {
        scope?: string[];
        sessionBinding?: string;
        params?: Record<string, string>;
    }): Promise<{
        url: string;
        session: string;
        warnings: import("./providers/_base.js").Warning[];
    }>;
    /**
     * Complete the flow. Provide the `session` returned by `authorize`,
     * or rely on the configured store to look it up by `query.state`.
     *
     * @param {string} name
     * @param {Record<string, unknown>} query   the callback query params
     * @param {{ session?: string, sessionBinding?: string }} [options]
     */
    callback(name: string, query: Record<string, unknown>, options?: {
        session?: string;
        sessionBinding?: string;
    }): Promise<{
        tokens: Record<string, unknown>;
        user: NormalizedUser;
        warnings: Warning[];
    }>;
    /**
     * Exchange a refresh token for a fresh access token (RFC 6749 §6).
     *
     * @param {string} name
     * @param {string} refreshToken
     * @returns {Promise<Record<string, unknown>>}
     */
    refresh(name: string, refreshToken: string): Promise<Record<string, unknown>>;
    /**
     * Revoke an access or refresh token (RFC 7009).
     *
     * @param {string} name
     * @param {string} token
     * @param {string} [tokenTypeHint]  `'access_token'` | `'refresh_token'`
     * @returns {Promise<Record<string, unknown>>}
     */
    revoke(name: string, token: string, tokenTypeHint?: string): Promise<Record<string, unknown>>;
    /** @returns {string[]} the registered provider ids */
    readonly providers: string[];
    /** @param {string} name @returns {boolean} */
    has(name: string): boolean;
};
export type OAuthConfig = {
    /**
     * app origin, e.g. `https://app.com`
     */
    baseUrl: string;
    /**
     * callback template, e.g. `/auth/{provider}/callback`
     */
    callback: string;
    /**
     * optional server-side session store (keyed by `state`)
     */
    store?: SessionStore | undefined;
    security?: {
        maxAuthAge?: string | number;
        clockTolerance?: string | number;
    } | undefined;
    /**
     * provider descriptors from `./providers/*`
     */
    providers: ResolvedProvider[];
};
export type SessionStore = {
    set: (key: string, value: string, ttlMs: number) => unknown;
    get: (key: string) => (string | null | undefined) | Promise<string | null | undefined>;
    delete: (key: string) => unknown;
};
export type ResolvedProvider = import("./providers/_base.js").ResolvedProvider;