/**
 * The pinned transport's error class, in its own module.
 *
 * It lives apart from `oauth-proxy.ts` only so that `oauth/pinned-dns.ts` — the
 * shared DNS half that `oauth-proxy.ts` itself imports — can throw it without
 * an import cycle. `oauth-proxy.ts` re-exports the symbol, so every existing
 * `import { OAuthProxyError } from "./oauth-proxy.js"` keeps working and
 * `instanceof` keeps meaning one class.
 */
declare class OAuthProxyError extends Error {
    status: number;
    constructor(status: number, message: string);
}

interface OAuthProxyRequest {
    url: string;
    method?: string;
    body?: unknown;
    headers?: Record<string, string>;
    httpsOnly?: boolean;
    /** Redirect handling. httpsOnly always forces "manual" (cannot be
     * weakened); otherwise an explicit value is honored and omission preserves
     * the historical "follow". */
    redirect?: "follow" | "manual";
    /** Bound DNS, connection setup, redirects, and the response-body read. */
    timeoutMs?: number;
    /** Caller-owned cancellation, composed with the timeout: whichever aborts
     * first ends the request, socket included. */
    signal?: AbortSignal;
}
interface OAuthProxyResponse {
    status: number;
    statusText: string;
    headers: Record<string, string>;
    body: unknown;
    finalUrl: string;
}

interface ValidatedUrl {
    url: URL;
}
declare function validateUrl(url: string, httpsOnly?: boolean): Promise<ValidatedUrl>;
/**
 * SSRF-hardened GET of a caller-influenced public document (the CIMD client
 * metadata document). Unlike `validateUrl` + `fetch` — which resolve DNS twice
 * and leave a rebinding window — this resolves once, rejects any private/reserved
 * result (RFC 6890), and PINS that address into the connection via a custom
 * `lookup`, so the socket connects to the validated IP with no second resolution.
 * HTTPS-only, does not follow redirects, and caps the body (CIMD draft-02 §8.6).
 */
declare function fetchPinnedPublicDocument(urlString: string, opts?: {
    headers?: Record<string, string>;
    timeoutMs?: number;
    maxBytes?: number;
}): Promise<OAuthProxyResponse>;
declare function executeOAuthProxy(req: OAuthProxyRequest): Promise<OAuthProxyResponse>;
declare function executeDebugOAuthProxy(req: OAuthProxyRequest): Promise<OAuthProxyResponse>;
declare function fetchOAuthMetadata(url: string, httpsOnly?: boolean, timeoutMs?: number): Promise<{
    metadata: Record<string, unknown>;
    finalUrl: string;
    status?: undefined;
} | {
    status: number;
    statusText: string;
}>;

export { OAuthProxyError as O, type OAuthProxyRequest as a, type OAuthProxyResponse as b, executeOAuthProxy as c, fetchPinnedPublicDocument as d, executeDebugOAuthProxy as e, fetchOAuthMetadata as f, validateUrl as v };