/**
 * A JSON response with the token-endpoint no-store headers.
 *
 * @param {number} status
 * @param {Record<string, unknown>} payload
 * @param {Record<string, string>} [headers]
 * @returns {ServerResponse}
 */
export function json(status: number, payload: Record<string, unknown>, headers?: Record<string, string>): ServerResponse;
/**
 * A 302 redirect. `params` are merged into the target's query string
 * (existing query preserved) so the authorization-endpoint success and
 * error redirects share one builder.
 *
 * @param {string} location                       absolute redirect URI
 * @param {Record<string, string | undefined>} [params]
 * @param {Record<string, string>} [headers]
 * @returns {ServerResponse}
 */
export function redirect(location: string, params?: Record<string, string | undefined>, headers?: Record<string, string>): ServerResponse;
/**
 * Render a {@link ServerError} as a direct JSON error body (RFC 6749
 * §5.2) — the shape used by the token, introspection, and revocation
 * endpoints. `invalid_client` carries a `WWW-Authenticate` challenge.
 *
 * @param {ServerError} err
 * @returns {ServerResponse}
 */
export function jsonError(err: ServerError): ServerResponse;
/**
 * Render a {@link ServerError} raised at the authorization endpoint as a
 * redirect back to the client (RFC 6749 §4.1.2.1), echoing `state` and —
 * per RFC 9207 — the issuer identifier. When there is no usable
 * `redirect_uri` (unknown client / mismatched URI) the error must NOT be
 * redirected (open-redirect / phishing lever); the caller passes
 * `redirectUri: undefined` and gets a direct JSON body instead.
 *
 * @param {string | undefined} redirectUri
 * @param {ServerError} err
 * @param {{ issuer?: string }} [context]
 * @returns {ServerResponse}
 */
export function redirectError(redirectUri: string | undefined, err: ServerError, context?: {
    issuer?: string;
}): ServerResponse;
/**
 * Turn any thrown value into a response. A {@link ServerError} renders as
 * its wire shape; anything else is an internal fault masked as
 * `server_error` (never leak an internal message to the client).
 *
 * @param {unknown} err
 * @param {{ redirectUri?: string, issuer?: string }} [context]
 * @returns {ServerResponse}
 */
export function errorResponse(err: unknown, context?: {
    redirectUri?: string;
    issuer?: string;
}): ServerResponse;
export type ServerResponse = {
    status: number;
    headers: Record<string, string>;
    body: string;
};
import { ServerError } from './errors.js';