/**
 * OAuth Provider Base Class
 *
 * Handles OAuth 2.0 authentication flow with any compliant provider
 */
import type { OAuthProviderConfig, Logger, CSRFTokenData, TokenResponse, OAuthUser, IOAuthProvider } from '../types.ts';
export declare class OAuthProvider implements IOAuthProvider {
    config: OAuthProviderConfig;
    logger?: Logger;
    private jwksClient?;
    constructor(config: OAuthProviderConfig, logger?: Logger);
    private initializeJwksClient;
    private validateConfig;
    /**
     * Generate authorization URL for OAuth login
     */
    getAuthorizationUrl(state: string, redirectUri?: string): string;
    /**
     * Exchange authorization code for access token
     */
    exchangeCodeForToken(code: string, redirectUri?: string): Promise<TokenResponse>;
    /**
     * Get user info using access token
     */
    getUserInfo(accessToken: string, idTokenClaims?: any): Promise<any>;
    /**
     * Fetch user info from the provider's userinfo endpoint
     */
    fetchUserInfo(accessToken: string): Promise<any>;
    /**
     * Verify ID token with proper signature verification using JWKS
     */
    verifyIdToken(idToken: string): Promise<any>;
    /**
     * Verify ID token claims without signature verification
     * Used as fallback when JWKS is not available
     */
    private verifyIdTokenClaims;
    /**
     * Map OAuth user info to Harper user object
     */
    mapUserToHarper(userInfo: any): OAuthUser;
    /**
     * Extract a claim from user info (supports nested paths)
     */
    private extractClaim;
    /**
     * Generate and store CSRF token for protection
     */
    generateCSRFToken(metadata?: Record<string, any>): Promise<string>;
    /**
     * Verify and consume CSRF token
     */
    verifyCSRFToken(token: string): Promise<CSRFTokenData | null>;
    /**
     * Refresh an access token using a refresh token
     */
    refreshAccessToken(refreshToken: string): Promise<TokenResponse>;
}