import { C as JwsHeaderParameters, N as MonoCloudUser, W as SecurityAlgorithms, _ as IdTokenClaims, t as AccessToken, x as Jwk } from "../types-DQyiPtSD.mjs";
//#region src/utils/internal.d.ts
/**
 * @ignore
 * Converts a string to a Base64URL encoded string.
 *
 * @param input - The string to encode.
 *
 * @returns The Base64URL encoded string.
 */
declare const toB64Url: (input: string) => string;
/**
 * @ignore
 * Parses a string value into a boolean.
 *
 * @param value - The string value to parse.
 *
 * @returns `true` if "true", `false` if "false", otherwise `undefined`.
 */
declare const getBoolean: (value?: string) => boolean | undefined;
/**
 * @ignore
 * Parses a string value into a number.
 *
 * @param value - The string value to parse.
 *
 * @returns The parsed number, or `undefined` if empty or invalid.
 */
declare const getNumber: (value?: string) => number | undefined;
/**
 * @ignore
 * Ensures that a string has a leading forward slash.
 *
 * @param val - The string to check.
 *
 * @returns The string with a leading slash.
 */
declare const ensureLeadingSlash: (val?: string) => string;
/**
 * @ignore
 * Removes a trailing forward slash from a string.
 *
 * @param val - The string to check.
 *
 * @returns The string without a trailing slash.
 */
declare const removeTrailingSlash: (val?: string) => string;
/**
 * @ignore
 * Checks if a value is present (not null, undefined, or an empty string).
 *
 * @param value - The value to check.
 *
 * @returns `true` if the value is present, `false` otherwise.
 */
declare const isPresent: (value?: string | number | boolean) => value is string | number | boolean;
/**
 * @ignore
 * Checks if a URL is an absolute URL (starts with http:// or https://).
 *
 * @param url - The URL to check.
 *
 * @returns `true` if absolute, `false` otherwise.
 */
declare const isAbsoluteUrl: (url: string) => boolean;
/**
 * @ignore
 * Checks if two URLs have the same origin (host and port).
 *
 * @param url - The first URL.
 * @param urlToCheck - The second URL to compare against.
 *
 * @returns `true` if they share the same origin, `false` otherwise.
 */
declare const isSameHost: (url: string, urlToCheck: string) => boolean;
/**
 * @ignore
 * Converts a string to a Uint8Array using TextEncoder.
 *
 * @param str - The string to convert.
 *
 * @returns A Uint8Array representation of the string.
 */
declare const stringToArrayBuffer: (str: string) => Uint8Array;
/**
 * @ignore
 * Converts an ArrayBuffer to a string using TextDecoder.
 *
 * @param buffer - The buffer to convert.
 *
 * @returns The decoded string.
 */
declare const arrayBufferToString: (buffer: ArrayBuffer) => string;
/**
 * @ignore
 * Encodes a string as standard (padded) Base64 from its UTF-8 bytes.
 *
 * @param input - The string to encode.
 *
 * @returns The Base64 encoded string.
 */
declare const encodeBase64: (input: string) => string;
/**
 * @ignore
 * Compares two strings without leaking their contents through timing.
 *
 * @param a - The first string.
 * @param b - The second string.
 *
 * @returns `true` if the strings are equal.
 */
declare const timingSafeEqual: (a: string, b: string) => boolean;
/**
 * @ignore
 * Converts a Base64URL string back to a standard Base64 string with padding.
 *
 * @param input - The Base64URL string.
 *
 * @returns A standard Base64 string.
 */
declare const fromB64Url: (input: string) => string;
/**
 * @ignore
 * Decodes a Base64URL encoded string.
 *
 * @param input - The Base64URL string to decode.
 *
 * @returns The decoded plaintext string.
 */
declare const decodeBase64Url: (input: string) => string;
/**
 * @ignore
 * Converts a Uint8Array to a Base64URL encoded string.
 *
 * @param buffer - The buffer to encode.
 *
 * @returns The Base64URL encoded string.
 */
declare const arrayBufferToBase64: (buffer: Uint8Array) => string;
/**
 * @ignore
 * Gets the current Unix timestamp in seconds.
 *
 * @returns The current timestamp.
 */
declare const now: () => number;
/**
 * Retrieves a public CryptoKey from a JWK set based on the JWS header.
 *
 * @param jwks - The set of JSON Web Keys.
 * @param header - The JWS header containing the algorithm and key ID.
 *
 * @returns A promise that resolves to the CryptoKey.
 *
 * @throws If no applicable key or multiple keys are found or the algorithm is unsupported.
 */
declare const getPublicSigKeyFromIssuerJwks: (jwks: Jwk[], header: JwsHeaderParameters) => Promise<CryptoKey>;
/**
 * @ignore
 * Encodes a Uint8Array or ArrayBuffer into a Base64URL string using chunked processing.
 *
 * @param input - The data to encode.
 *
 * @returns The Base64URL encoded string.
 */
declare const encodeBase64Url: (input: Uint8Array | ArrayBuffer) => string;
/**
 * @ignore
 * Computes a SHA-256 hash of the input string and returns it as a Base64URL encoded string.
 *
 * @param input - The string to hash.
 *
 * @returns The Base64URL encoded SHA-256 hash.
 */
declare const sha256: (input: string) => Promise<string>;
/**
 * @ignore
 * Computes the base64url-encoded left-most half of the digest of `value`,
 * using the hash algorithm implied by an id token signing algorithm.
 *
 * @param value - The value to hash (for example an access token, code or state).
 * @param alg - The id token signing algorithm.
 *
 * @returns The base64url encoded left-most half of the digest.
 */
declare const hashTokenValue: (value: string, alg: SecurityAlgorithms) => Promise<string>;
/**
 * @ignore
 * Validates an OpenID Connect hash claim (such as `at_hash`, `c_hash` or
 * `s_hash`) against the value it was derived from.
 *
 * @param value - The value the hash was derived from (for example the access token or state).
 * @param expectedHash - The hash claim value present in the id token.
 * @param alg - The id token signing algorithm.
 *
 * @returns `true` when the computed hash matches `expectedHash`, `false` otherwise.
 */
declare const validateTokenHash: (value: string, expectedHash: string, alg: SecurityAlgorithms) => Promise<boolean>;
/**
 * @ignore
 * Generates a random Base64URL encoded string.
 *
 * @param length - The number of random bytes to generate.
 *
 * @returns A random Base64URL string.
 */
declare const randomBytes: (length?: number) => string;
/**
 * @ignore
 * Checks if a value is a non-null, non-array JSON object.
 *
 * @param input - The value to check.
 *
 * @returns `true` if the value is a JSON object.
 */
declare const isJsonObject: <T>(input: unknown) => input is T;
/**
 * @ignore
 * Resolves a client secret supplied as a string.
 *
 * When the string parses to a JWK — a JSON object with a string `kty` member, such as the
 * private key used with the `private_key_jwt` client authentication method — the parsed object
 * is returned. Any other value (a plain-text secret, non-JWK JSON, or a value already provided
 * as an object) is returned unchanged.
 *
 * @param value - The raw client secret (a string, a JWK object, or `undefined`).
 *
 * @returns The parsed JWK object, the original string secret, or `undefined`.
 */
declare const parseClientSecret: (value?: string | Jwk) => string | Jwk | undefined;
/**
 * @ignore
 * Parses a space-separated string into an array of strings.
 *
 * @param s - The space-separated string.
 *
 * @returns An array of strings, or `undefined` if input is empty.
 */
declare const parseSpaceSeparated: (s?: string) => string[] | undefined;
/**
 * @ignore
 * Parses a space-separated string into a Set of strings.
 *
 * @param s - The space-separated string.
 *
 * @returns A Set containing the unique strings.
 */
declare const parseSpaceSeparatedSet: (s?: string) => Set<string>;
/**
 * @ignore
 * Compares two Sets for equality.
 *
 * @param a - The first Set.
 * @param b - The second Set.
 * @param strict - If `true`, requires both sets to be the same size. Defaults to `true`.
 *
 * @returns `true` if the sets are equal.
 */
declare const setsEqual: (a: Set<string>, b: Set<string>, strict?: boolean) => boolean;
/**
 * Finds a specific access token in an array based on resource and scopes.
 *
 * @param tokens - The array of access tokens.
 * @param resource - Space-separated resource indicators.
 * @param scopes - Space-separated scopes.
 *
 * @returns The matching AccessToken, or `undefined` if not found.
 */
declare const findToken: (tokens?: AccessToken[], resource?: string, scopes?: string) => AccessToken | undefined;
/**
 * @ignore
 * Builds the session user claims from existing claims and newly fetched claims.
 *
 * @param existingUser - Existing session user claims.
 * @param idTokenClaims - Claims extracted from ID token.
 * @param userinfoClaims - Claims fetched from UserInfo endpoint.
 * @param strict - If `true`, creates claims from new inputs only (falls back to existing when none). If `false`, merges into existing claims.
 *
 * @returns Updated user claims for the session.
 */
declare const profileSync: (existingUser?: MonoCloudUser, idTokenClaims?: Partial<IdTokenClaims>, userinfoClaims?: Partial<MonoCloudUser>, strict?: boolean) => MonoCloudUser;
//#endregion
export { arrayBufferToBase64, arrayBufferToString, decodeBase64Url, encodeBase64, encodeBase64Url, ensureLeadingSlash, findToken, fromB64Url, getBoolean, getNumber, getPublicSigKeyFromIssuerJwks, hashTokenValue, isAbsoluteUrl, isJsonObject, isPresent, isSameHost, now, parseClientSecret, parseSpaceSeparated, parseSpaceSeparatedSet, profileSync, randomBytes, removeTrailingSlash, setsEqual, sha256, stringToArrayBuffer, timingSafeEqual, toB64Url, validateTokenHash };
//# sourceMappingURL=internal.d.mts.map