import { A as MonoCloudRawResponse, B as RefreshGrantOptions, C as JwsHeaderParameters, D as MonoCloudOidcBackendClientOptions, E as MonoCloudClientOptionsBase, F as OnSessionCreating, G as TokenValidationOptionsBase, H as ResponseModes, I as ParResponse, J as ValidateJwtAccessTokenOptions, K as Tokens, L as Prompt, M as MonoCloudTokenErrorCode, N as MonoCloudUser, O as MonoCloudOidcClientBaseOptions, P as MtlsEndpointAliases, R as PushedAuthorizationParams, S as Jwks, T as LogoutTokenClaims, U as ResponseTypes, V as RefreshSessionOptions, W as SecurityAlgorithms, _ as IdTokenClaims, a as AuthenticateOptions, b as IssuerMetadata, c as CallbackParams, d as CodeChallengeMethod, f as DeviceAuthorizationParams, g as Group, h as EndSessionParameters, i as AuthState, j as MonoCloudSession, k as MonoCloudOidcClientOptions, l as CertificateBindingValidation, m as DisplayOptions, n as AccessTokenClaims, o as Authenticators, p as DeviceAuthorizationResponse, q as UserinfoResponse, r as Address, s as AuthorizationParams, t as AccessToken, u as ClientAuthMethod, v as IntrospectOptions, w as JwtClaims, x as Jwk, y as IsUserInGroupOptions, z as RefetchUserInfoOptions } from "./types-DQyiPtSD.mjs";
//#region src/errors/monocloud-auth-base-error.d.ts
/**
 * Base class for all MonoCloud authentication errors.
 *
 * All errors thrown by the MonoCloud SDK extend this class, allowing applications to safely detect and handle MonoCloud-specific failures using `instanceof`.
 *
 * @category Error Classes
 */
declare class MonoCloudAuthBaseError extends Error {
  /**
   * The raw HTTP response this error was derived from.
   */
  readonly raw?: MonoCloudRawResponse;
  constructor(message?: string, raw?: MonoCloudRawResponse);
}
//#endregion
//#region src/errors/monocloud-op-error.d.ts
/**
 * OAuth error returned by the authorization server.
 *
 * @category Error Classes
 */
declare class MonoCloudOPError extends MonoCloudAuthBaseError {
  /**
   * OAuth error code returned by the authorization server.
   *
   * When the response carries no readable error body, this is inferred from the endpoint and status code instead.
   */
  error: string;
  /** Human-readable description of the error. */
  errorDescription?: string;
  constructor(error: string, errorDescription?: string, raw?: MonoCloudRawResponse);
}
//#endregion
//#region src/errors/monocloud-http-error.d.ts
/**
 * Error thrown when a request to the MonoCloud authorization server fails.
 *
 * This error typically indicates a network failure, an unexpected HTTP response, or an unsuccessful response returned by the authorization server.
 *
 * @category Error Classes
 */
declare class MonoCloudHttpError extends MonoCloudAuthBaseError {
  /**
   * HTTP status code of the response that caused the error.
   *
   * Undefined when no response was received, such as a network failure.
   */
  get status(): number | undefined;
  /**
   * HTTP status text of the response that caused the error.
   */
  get statusText(): string | undefined;
}
//#endregion
//#region src/errors/monocloud-token-error.d.ts
/**
 * Error thrown when a token operation fails.
 *
 * @category Error Classes
 */
declare class MonoCloudTokenError extends MonoCloudAuthBaseError {
  /** Code identifying why the token operation failed. */
  readonly code: MonoCloudTokenErrorCode;
  constructor(message?: string, code?: MonoCloudTokenErrorCode, raw?: MonoCloudRawResponse);
}
//#endregion
//#region src/errors/monocloud-validation-error.d.ts
/**
 * Error thrown when validation fails.
 *
 * @category Error Classes
 */
declare class MonoCloudValidationError extends MonoCloudAuthBaseError {}
//#endregion
//#region src/monocloud-oidc-client-base.d.ts
/**
 * @category Classes
 */
declare class MonoCloudOidcClientBase {
  /**
   * The normalized tenant domain URL used as the base for discovery endpoints.
   */
  protected readonly tenantDomain: string;
  /**
   * Cached JSON Web Key Set retrieved from the issuer's JWKS endpoint.
   */
  protected jwks?: Jwks;
  /**
   * Timestamp (in seconds) when the cached JWKS expires.
   */
  protected jwksCacheExpiry: number;
  /**
   * Duration (in seconds) for which the JWKS is cached. Defaults to 300 (5 minutes).
   */
  protected jwksCacheDuration: number;
  /**
   * Cached issuer metadata retrieved from the OpenID Connect discovery endpoint.
   */
  protected metadata?: IssuerMetadata;
  /**
   * Timestamp (in seconds) when the cached metadata expires.
   */
  protected metadataCacheExpiry: number;
  /**
   * Duration (in seconds) for which the metadata is cached. Defaults to 300 (5 minutes).
   */
  protected metadataCacheDuration: number;
  /**
   * Custom fetch implementation used for making HTTP requests. Falls back to the global `fetch` if not provided.
   */
  protected fetcher?: typeof fetch;
  /**
   * Maximum time (in milliseconds) to wait for a response from the authorization server before
   * aborting the request.
   */
  protected readonly responseTimeout?: number;
  /**
   * Identifier of the trust store whose mTLS endpoint aliases should be used, if any.
   */
  protected readonly trustStoreId?: string;
  /**
   * Optional custom resolver for the issuer metadata, used instead of the discovery request.
   */
  protected readonly metadataResolver?: () => IssuerMetadata | Promise<IssuerMetadata>;
  /**
   * Optional custom resolver for the JSON Web Key Set, used instead of the JWKS request.
   */
  protected readonly jwksResolver?: () => Jwks | Promise<Jwks>;
  /**
   * Whether the configured client authentication method uses mutual TLS, and therefore requires
   * the mTLS endpoint aliases from the issuer metadata.
   */
  protected readonly usesMtlsEndpoints: boolean;
  /**
   * Creates a new instance of MonoCloudOidcClientBase.
   *
   * @param options - Base client configuration options.
   */
  constructor(options: MonoCloudOidcClientBaseOptions);
  /**
   * Fetches the authorization server metadata from the .well-known endpoint.
   * The metadata is cached for 5 minutes by default.
   *
   * @param forceRefresh - If `true`, bypasses the cache and fetches fresh metadata from the server.
   *
   * @returns The issuer metadata for the tenant, retrieved from the OpenID Connect discovery endpoint.
   *
   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or
   * unexpected status code during the request or a serialization error while processing the response.
   *
   */
  getMetadata(forceRefresh?: boolean): Promise<IssuerMetadata>;
  /**
   * Fetches the JSON Web Keys used to sign the ID token.
   * The JWKS is cached for 5 minutes by default.
   *
   * @param forceRefresh - If `true`, bypasses the cache and fetches fresh set of JWKS from the server.
   *
   * @returns The JSON Web Key Set containing the public keys for token verification.
   *
   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or
   * unexpected status code during the request or a serialization error while processing the response.
   *
   */
  getJwks(forceRefresh?: boolean): Promise<Jwks>;
  /**
   * Resolves an endpoint URL from the issuer metadata, preferring the mutual-TLS alias when the
   * client authenticates over mTLS.
   *
   * @param metadata - The issuer metadata.
   * @param endpoint - The endpoint to resolve.
   *
   * @returns The resolved endpoint URL.
   *
   * @throws {@link MonoCloudValidationError} - When the required endpoint is not available in the issuer metadata.
   */
  protected resolveEndpoint(metadata: IssuerMetadata, endpoint: keyof MtlsEndpointAliases): string;
  /**
   * Decodes the payload of a JSON Web Token (JWT) and returns it as an object.
   *
   * >Note: THIS METHOD DOES NOT VERIFY JWT TOKENS.
   *
   * @param jwt - JWT to decode.
   *
   * @returns Decoded payload.
   *
   * @throws {@link MonoCloudTokenError} - If decoding fails
   *
   */
  static decodeJwt(jwt: string): JwtClaims;
}
//#endregion
//#region src/monocloud-oidc-client.d.ts
/**
 * @category Classes
 */
declare class MonoCloudOidcClient extends MonoCloudOidcClientBase {
  private readonly clientId;
  private readonly clientSecret?;
  private readonly authMethod;
  private readonly idTokenSigningAlgorithm;
  /**
   * Creates a new instance of MonoCloudOidcClient.
   *
   * @param tenantDomain - The tenant domain URL.
   * @param clientId - Client id of the application registered in MonoCloud.
   * @param options - Additional client configuration options.
   */
  constructor(tenantDomain: string, clientId: string, options?: MonoCloudOidcClientOptions);
  /**
   * Generates an authorization URL with specified parameters.
   *
   * If no values are provided for `responseType`, or `codeChallengeMethod`, they default to `code`, and `S256`, respectively.
   *
   * @param params - Authorization URL parameters.
   *
   * @returns Tenant's authorization URL.
   *
   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or
   * unexpected status code during the request or a serialization error while processing the response.
   *
   */
  authorizationUrl(params: AuthorizationParams): Promise<string>;
  /**
   * Performs a pushed authorization request.
   *
   * @param params - Authorization Parameters.
   *
   * @returns Response from Pushed Authorization Request (PAR) endpoint.
   *
   * @throws {@link MonoCloudOPError} - When the request is invalid.
   *
   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or
   * unexpected status code during the request or a serialization error while processing the response.
   *
   */
  pushedAuthorizationRequest(params: PushedAuthorizationParams): Promise<ParResponse>;
  /**
   * Fetches userinfo associated with the provided access token.
   *
   * @param accessToken - A valid access token used to retrieve userinfo.
   *
   * @returns The authenticated user's claims.
   *
   * @throws {@link MonoCloudOPError} - When the OpenID Provider returns a standardized
   * OAuth 2.0 error (e.g., 'invalid_token') in the 'WWW-Authenticate' header
   * following a 401 Unauthorized response.
   *
   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or
   * unexpected status code during the request or a serialization error while processing the response.
   *
   * @throws {@link MonoCloudValidationError} - When the access token is invalid.
   *
   */
  userinfo(accessToken: string): Promise<UserinfoResponse>;
  /**
   * Generates OpenID end session URL for signing out.
   *
   * Note - The `state` is added only when `postLogoutRedirectUri` is present.
   *
   * @param params - Parameters to build end session URL.
   *
   * @returns Tenant's end session URL.
   *
   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or
   * unexpected status code during the request or a serialization error while processing the response.
   *
   */
  endSessionUrl(params: EndSessionParameters): Promise<string>;
  /**
   * Exchanges an authorization code for tokens.
   *
   * @param code - The authorization code received from the authorization server.
   * @param redirectUri - The redirect URI used in the initial authorization request.
   * @param codeVerifier - Code verifier for PKCE.
   * @param resource - Space-separated list of resources the access token should be scoped to.
   *
   * @returns Tokens obtained by exchanging an authorization code at the token endpoint.
   *
   * @throws {@link MonoCloudOPError} - When the OpenID Provider returns a standardized
   * OAuth 2.0 error response.
   *
   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or
   * unexpected status code during the request or a serialization error while processing the response.
   *
   */
  exchangeAuthorizationCode(code: string, redirectUri: string, codeVerifier?: string, resource?: string): Promise<Tokens>;
  /**
   * Exchanges a refresh token for new tokens.
   *
   * @param refreshToken - The refresh token used to request new tokens.
   * @param options - Refresh grant options.
   *
   * @returns Tokens obtained by exchanging a refresh token at the token endpoint.
   *
   * @throws {@link MonoCloudOPError} - When the OpenID Provider returns a standardized
   * OAuth 2.0 error response.
   *
   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or
   * unexpected status code during the request or a serialization error while processing the response.
   *
   */
  refreshGrant(refreshToken: string, options?: RefreshGrantOptions): Promise<Tokens>;
  /**
   * Generates a session with user and tokens by exchanging authorization code from callback params.
   *
   * @param code - The authorization code received from the callback.
   * @param redirectUri - The redirect URI that was used in the authorization request.
   * @param requestedScopes - A space-separated list of scopes originally requested via the `/authorize` endpoint.
   * This is stored in the session to ensure the correct access token can be identified and refreshed during `refreshSession()`.
   * @param resource - A space-separated list of resource indicators originally requested via the `/authorize` endpoint.
   * Used alongside scopes to uniquely identify and refresh the specific access token associated with these resources.
   * @param options - Options for authenticating a user with authorization code.
   *
   * @returns The user's session containing authentication tokens and user information.
   *
   * @throws {@link MonoCloudValidationError} - When the token scope does not contain the openid scope,
   * or if 'expires_in' or 'scope' is missing from the token response.
   *
   * @throws {@link MonoCloudOPError} - When the OpenID Provider returns a standardized.
   * OAuth 2.0 error response.
   *
   * @throws {@link MonoCloudTokenError} - If ID Token validation fails.
   *
   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or
   * unexpected status code during the request or a serialization error while processing the response.
   *
   */
  authenticate(code: string, redirectUri: string, requestedScopes: string, resource?: string, options?: AuthenticateOptions): Promise<MonoCloudSession>;
  /**
   * Refetches user information for an existing session using the userinfo endpoint.
   * Updates the session's user object with the latest user information.
   *
   * @param accessToken - Access token used to fetch the userinfo.
   * @param session - The current MonoCloudSession.
   * @param options - Userinfo refetch options.
   *
   * @returns Updated session with the latest userinfo.
   *
   * @throws {@link MonoCloudValidationError} - When the token scope does not contain `openid` scope
   *
   * @throws {@link MonoCloudOPError} - When the OpenID Provider returns a standardized
   * OAuth 2.0 error response.
   *
   * @throws {@link MonoCloudTokenError} - If ID Token validation fails
   *
   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or
   * unexpected status code during the request or a serialization error while processing the response.
   *
   */
  refetchUserInfo(accessToken: AccessToken, session: MonoCloudSession, options?: RefetchUserInfoOptions): Promise<MonoCloudSession>;
  /**
   * Refreshes an existing session using the refresh token.
   * This function requests new tokens using the refresh token and optionally updates user information.
   *
   * @param session - The current MonoCloudSession containing the refresh token.
   * @param options - Session refresh options.
   *
   * @returns User's session containing refreshed authentication tokens and user information.
   *
   * @throws {@link MonoCloudValidationError} - If the refresh token is not present in the session,
   * or if 'expires_in' or 'scope' (including the openid scope) is missing from the token response.
   *
   * @throws {@link MonoCloudOPError} - When the OpenID Provider returns a standardized
   * OAuth 2.0 error response.
   *
   * @throws {@link MonoCloudTokenError} - If ID Token validation fails
   *
   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or
   * unexpected status code during the request or a serialization error while processing the response.
   *
   */
  refreshSession(session: MonoCloudSession, options?: RefreshSessionOptions): Promise<MonoCloudSession>;
  /**
   * Revokes an access token or refresh token, rendering it invalid for future use.
   *
   * @param token - The token string to be revoked.
   * @param tokenType - Hint about the token type ('access_token' or 'refresh_token').
   *
   * @returns If token revocation succeeded.
   *
   * @throws {@link MonoCloudValidationError} - If token is invalid or unsupported token type
   *
   * @throws {@link MonoCloudOPError} - When the OpenID Provider returns a standardized
   * OAuth 2.0 error response.
   *
   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or
   * unexpected status code during the request or a serialization error while processing the response.
   */
  revokeToken(token: string, tokenType?: string): Promise<void>;
  /**
   * Validates an ID Token.
   *
   * @param idToken - The ID Token JWT string to validate.
   * @param jwks - Array of JSON Web Keys (JWK) used to verify the token's signature.
   * @param clockSkew - Number of seconds to adjust the current time to account for clock differences.
   * @param clockTolerance - Additional time tolerance in seconds for time-based claim validation.
   * @param maxAge - Maximum authentication age in seconds.
   * @param nonce - Nonce value to validate against the token's nonce claim.
   *
   * @returns Validated ID Token claims.
   *
   * @throws {@link MonoCloudTokenError} - If ID Token validation fails
   *
   */
  validateIdToken(idToken: string, jwks: Jwk[], clockSkew: number, clockTolerance: number, maxAge?: number, nonce?: string): Promise<IdTokenClaims>;
  /**
   * Validates an OpenID Connect Back-Channel Logout Token.
   *
   * @param logoutToken - The Logout Token JWT string to validate.
   * @param clockSkew - Number of seconds to adjust the current time to account for clock differences.
   * @param clockTolerance - Additional time tolerance in seconds for time-based claim validation.
   *
   * @returns Validated Logout Token claims.
   *
   * @throws {@link MonoCloudTokenError} - If Logout Token validation fails
   *
   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error while fetching the issuer metadata or JWKS.
   *
   */
  validateLogoutToken(logoutToken: string, clockSkew: number, clockTolerance: number): Promise<LogoutTokenClaims>;
  /**
   * Performs a device authorization request.
   *
   * @param params - Device Authorization Parameters.
   *
   * @returns Response from Device Authorization endpoint.
   *
   * @throws {@link MonoCloudOPError} - When the request is invalid.
   *
   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or
   * unexpected status code during the request or a serialization error while processing the response.
   *
   */
  deviceAuthorizationRequest(params: DeviceAuthorizationParams): Promise<DeviceAuthorizationResponse>;
  /**
   * Exchanges a device code for tokens.
   *
   * @param deviceCode - The device code received from the device authorization server.
   *
   * @returns Tokens obtained by exchanging a device code at the token endpoint.
   *
   * @throws {@link MonoCloudOPError} - When the authorization server returns a standardized
   * OAuth 2.0 error response.
   *
   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or
   * unexpected status code during the request or a serialization error while processing the response.
   *
   */
  deviceAuthorizationGrant(deviceCode: string): Promise<Tokens>;
}
//#endregion
//#region src/monocloud-oidc-backend-client.d.ts
/**
 * @category Classes
 */
declare class MonoCloudOidcBackendClient extends MonoCloudOidcClientBase {
  private readonly clientId?;
  private readonly clientSecret?;
  private readonly authMethod;
  private readonly audience;
  private readonly groupOptions?;
  /**
   * Number of seconds to adjust the current time to account for clock differences between the client and server during time-based claim validation. Defaults to 0.
   */
  protected clockSkew: number;
  /**
   * Additional time tolerance in seconds applied when validating time-based claims (`exp`, `nbf`). Defaults to 60 (1 minute).
   */
  protected clockTolerance: number;
  /**
   * Creates a new instance of MonoCloudOidcBackendClient.
   *
   * @param tenantDomain - The tenant domain URL.
   * @param audience - The expected audience value used to validate the `aud` claim in access tokens.
   * @param options - Additional client configuration options.
   */
  constructor(tenantDomain: string, audience: string, options?: MonoCloudOidcBackendClientOptions);
  /**
   * Validates an opaque access token using the OAuth 2.0 Token Introspection endpoint (RFC 7662).
   *
   * @param accessToken - The access token string to introspect.
   * @param options - Claims validation options.
   *
   * @returns Validated access token claims (without the `active` field).
   *
   * @throws {@link MonoCloudTokenError} - If the token is not active or claim validation fails.
   *
   * @throws {@link MonoCloudOPError} - When the introspection endpoint returns a standardized
   * OAuth 2.0 error response.
   *
   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or
   * unexpected status code during the request or a serialization error while processing the response.
   *
   * @throws {@link MonoCloudValidationError} - When the access token is empty or the introspection
   * endpoint is not available in the issuer metadata or claims validation fails.
   *
   */
  introspectAccessToken(accessToken: string, options?: IntrospectOptions): Promise<AccessTokenClaims>;
  /**
   * Validates a JWT access token by verifying the signature and claims.
   *
   * @param accessToken - The access token JWT string to validate.
   * @param options - Validation options.
   *
   * @returns Validated access token claims.
   *
   * @throws {@link MonoCloudTokenError} - If JWT parsing, signature verification, or claim validation fails.
   *
   * @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or
   * unexpected status code during the request or a serialization error while processing the response.
   *
   * @throws {@link MonoCloudValidationError} - When the access token is empty or claims validation fails.
   *
   */
  validateJwtAccessToken(accessToken: string, options?: ValidateJwtAccessTokenOptions): Promise<AccessTokenClaims>;
  /**
   * Sets clock skew used for access token time-based claim validation.
   *
   * @param clockSkew - Number of seconds to adjust the current time to account for clock differences.
   */
  setClockSkew(clockSkew: number): void;
  /**
   * Sets clock tolerance used for access token time-based claim validation.
   *
   * @param clockTolerance - Additional time tolerance in seconds for time-based claim validation.
   */
  setClockTolerance(clockTolerance: number): void;
  /**
   * Validates access token claims against the expected issuer, audience,
   * time-based claims, and any required scopes and groups.
   *
   * @param claims - The access token claims to validate.
   * @param scopes - Scopes the token must contain.
   * @param groups - Groups the token's subject must belong to.
   *
   * @throws {@link MonoCloudTokenError} - If any claim validation fails.
   */
  protected validateAccessTokenClaims(claims: AccessTokenClaims, scopes?: string[], groups?: string[]): void;
  /**
   * Validates that the access token is bound to the presented client
   * certificate by comparing the `cnf` claim's `x5t#S256` thumbprint against
   * the certificate's SHA-256 hash.
   *
   * @param accessTokenClaims - The access token claims containing the `cnf` claim.
   * @param mode - Controls whether certificate binding is validated.
   * @param certificate - The client certificate presented with the request.
   *
   * @throws {@link MonoCloudTokenError} - If the certificate is missing or malformed, the `cnf` claim is missing or invalid, or the hashes do not match.
   */
  protected validateCertificateBinding(accessTokenClaims: AccessTokenClaims, mode?: CertificateBindingValidation, certificate?: string): Promise<void>;
}
//#endregion
export { type AccessToken, type AccessTokenClaims, type Address, type AuthState, type AuthenticateOptions, type Authenticators, type AuthorizationParams, type CallbackParams, type CertificateBindingValidation, type ClientAuthMethod, type CodeChallengeMethod, type DeviceAuthorizationParams, type DeviceAuthorizationResponse, type DisplayOptions, type EndSessionParameters, type Group, type IdTokenClaims, type IntrospectOptions, type IsUserInGroupOptions, type IssuerMetadata, type Jwk, type Jwks, type JwsHeaderParameters, type JwtClaims, type LogoutTokenClaims, MonoCloudAuthBaseError, type MonoCloudClientOptionsBase, MonoCloudHttpError, MonoCloudOPError, MonoCloudOidcBackendClient, type MonoCloudOidcBackendClientOptions, MonoCloudOidcClient, MonoCloudOidcClientBase, type MonoCloudOidcClientBaseOptions, type MonoCloudOidcClientOptions, type MonoCloudRawResponse, type MonoCloudSession, MonoCloudTokenError, type MonoCloudTokenErrorCode, type MonoCloudUser, MonoCloudValidationError, type MtlsEndpointAliases, type OnSessionCreating, type ParResponse, type Prompt, type PushedAuthorizationParams, type RefetchUserInfoOptions, type RefreshGrantOptions, type RefreshSessionOptions, type ResponseModes, type ResponseTypes, type SecurityAlgorithms, type TokenValidationOptionsBase, type Tokens, type UserinfoResponse, type ValidateJwtAccessTokenOptions };
//# sourceMappingURL=index.d.mts.map