/**
 * Validate a single `resource` value as an absolute, fragment-free URI.
 *
 * @param {string} value
 * @returns {string}
 */
export function validateResource(value: string): string;
/**
 * Resolve the token `aud` from a token-request `resource` and the
 * resource bound at authorize time. When both are present they must
 * agree; a request for an unbound resource is `invalid_target`.
 *
 * @param {string | undefined} requested   `resource` on the token request
 * @param {string | undefined} bound       `resource` captured with the code / family
 * @param {Record<string, any>} _config
 * @returns {string | undefined}           the audience, or undefined when none applies
 */
export function resolveTokenAudience(requested: string | undefined, bound: string | undefined, _config: Record<string, any>): string | undefined;