/**
 * src/oauth/token.ts — OAuth 2.1 Token endpoint.
 *
 * POST /oauth/token
 *
 * Supports:
 *   - grant_type=authorization_code (with PKCE S256 verification)
 *   - grant_type=refresh_token (with rotation enforcement)
 *
 * Token issuance strategy:
 *   1. In-memory store validates code/PKCE/redirect_uri
 *   2. If Supabase env vars are set AND the stored code has a user_id,
 *      issue a real Supabase JWT via supabase-jwt.ts
 *   3. Otherwise fall back to local placeholder tokens (test path)
 *
 * The Supabase path is never attempted unless BOTH SUPABASE_URL and
 * SUPABASE_SERVICE_ROLE_KEY are set. Tests run without either.
 */
import express from "express";
import type { OAuthStore } from "./store.js";
export declare function oauthTokenRouter(store: OAuthStore): express.Router;