/**
 * @typedef {Object} GrantSubject
 * @property {string} subject
 * @property {string} clientId
 * @property {string[]} scope
 * @property {string | string[]} [audience]      resource indicator(s) → token `aud`
 * @property {string} [resource]                 the single resource bound for a refresh family
 * @property {string} [dpopJkt]                  DPoP thumbprint to sender-constrain the token
 * @property {Record<string, unknown>} [extra]   extra access-token claims (e.g. authorization_details)
 */
/**
 * Mint the access token and build the RFC 6749 §5.1 token response body.
 *
 * @param {Record<string, any>} config
 * @param {GrantSubject} grant
 * @returns {Promise<Record<string, unknown>>}
 */
export function buildAccessResponse(config: Record<string, any>, grant: GrantSubject): Promise<Record<string, unknown>>;
/**
 * Whether this client+server pair issues refresh tokens for the grant.
 *
 * @param {Record<string, any>} config
 * @param {import('../clients.js').Client} client
 * @returns {boolean}
 */
export function refreshAllowed(config: Record<string, any>, client: import("../clients.js").Client): boolean;
/**
 * Mint and attach an OIDC `id_token` to the response body when the server
 * is an OpenID Provider (`oidc` configured) AND the grant carried the
 * `openid` scope. A no-op otherwise, so a plain OAuth 2.1 AS is unaffected.
 *
 * @param {Record<string, any>} config
 * @param {Record<string, unknown>} body            the token response being assembled (mutated on issue)
 * @param {{ subject: string, clientId: string, scope: string[], nonce?: string, authTime?: number }} grant
 * @returns {Promise<void>}
 */
export function maybeIssueIdToken(config: Record<string, any>, body: Record<string, unknown>, grant: {
    subject: string;
    clientId: string;
    scope: string[];
    nonce?: string;
    authTime?: number;
}): Promise<void>;
/**
 * Create and persist a new refresh token. `familyId` is supplied to keep
 * a rotation within its family, or omitted to start a new one.
 *
 * @param {Record<string, any>} config
 * @param {GrantSubject & { familyId?: string }} grant
 * @returns {Promise<string>} the opaque refresh token
 */
export function mintRefreshToken(config: Record<string, any>, grant: GrantSubject & {
    familyId?: string;
}): Promise<string>;
export type GrantSubject = {
    subject: string;
    clientId: string;
    scope: string[];
    /**
     * resource indicator(s) → token `aud`
     */
    audience?: string | string[] | undefined;
    /**
     * the single resource bound for a refresh family
     */
    resource?: string | undefined;
    /**
     * DPoP thumbprint to sender-constrain the token
     */
    dpopJkt?: string | undefined;
    /**
     * extra access-token claims (e.g. authorization_details)
     */
    extra?: Record<string, unknown> | undefined;
};