/**
 * @typedef {Object} RawRequest
 * @property {string} [method]
 * @property {string} [url]                                   full URL or path (`?query` parsed when `query` is absent)
 * @property {Record<string, string | string[]>} [headers]
 * @property {Record<string, unknown>} [query]               pre-parsed query, else derived from `url`
 * @property {string | Record<string, unknown>} [body]       raw string or a framework-parsed object
 * @property {import('node:tls').PeerCertificate | Record<string, unknown>} [clientCertificate]  mTLS client cert (RFC 8705)
 *
 * @typedef {Object} ServerRequest
 * @property {string} method
 * @property {Record<string, string>} headers                lower-cased names
 * @property {Record<string, string>} query
 * @property {Record<string, string>} form                   parsed POST body params
 * @property {(name: string) => string | undefined} header
 * @property {(name: string) => string | undefined} param    query ∪ form (form wins)
 * @property {object | undefined} clientCertificate
 */
/**
 * Build a {@link ServerRequest} from a raw descriptor.
 *
 * @param {RawRequest} raw
 * @returns {ServerRequest}
 */
export function normalizeRequest(raw: RawRequest): ServerRequest;
/**
 * @typedef {Object} ClientCredentials
 * @property {string} clientId
 * @property {string} [clientSecret]
 * @property {'client_secret_basic' | 'client_secret_post'} [via]
 *
 * Extract a `client_id` / `client_secret` presented via HTTP Basic
 * (RFC 6749 §2.3.1) or POST body (§2.3.1 alt). Basic wins when both are
 * present, and presenting credentials both ways is itself an error
 * (§2.3.1). Assertion-based auth (`private_key_jwt` / mTLS) is resolved
 * separately from `client_assertion` / the client certificate.
 *
 * @param {ServerRequest} req
 * @returns {ClientCredentials | undefined}
 */
export function readClientCredentials(req: ServerRequest): ClientCredentials | undefined;
/**
 * Decode a `Basic` Authorization header. Per RFC 6749 §2.3.1 the id and
 * secret are `application/x-www-form-urlencoded` before base64 — a step
 * naive parsers skip, breaking secrets that contain `+`, `/` or `=`.
 *
 * @param {string | undefined} header
 * @returns {{ clientId: string, clientSecret: string } | undefined}
 */
export function parseBasicAuthorization(header: string | undefined): {
    clientId: string;
    clientSecret: string;
} | undefined;
export type RawRequest = {
    method?: string | undefined;
    /**
     * full URL or path (`?query` parsed when `query` is absent)
     */
    url?: string | undefined;
    headers?: Record<string, string | string[]> | undefined;
    /**
     * pre-parsed query, else derived from `url`
     */
    query?: Record<string, unknown> | undefined;
    /**
     * raw string or a framework-parsed object
     */
    body?: string | Record<string, unknown> | undefined;
    /**
     * mTLS client cert (RFC 8705)
     */
    clientCertificate?: any | Record<string, unknown>;
};
export type ServerRequest = {
    method: string;
    /**
     * lower-cased names
     */
    headers: Record<string, string>;
    query: Record<string, string>;
    /**
     * parsed POST body params
     */
    form: Record<string, string>;
    header: (name: string) => string | undefined;
    /**
     * query ∪ form (form wins)
     */
    param: (name: string) => string | undefined;
    clientCertificate: object | undefined;
};
export type ClientCredentials = {
    clientId: string;
    clientSecret?: string | undefined;
    /**
     * Extract a `client_id` / `client_secret` presented via HTTP Basic
     * (RFC 6749 §2.3.1) or POST body (§2.3.1 alt). Basic wins when both are
     * present, and presenting credentials both ways is itself an error
     * (§2.3.1). Assertion-based auth (`private_key_jwt` / mTLS) is resolved
     * separately from `client_assertion` / the client certificate.
     */
    via?: "client_secret_basic" | "client_secret_post" | undefined;
};