import type { OAuthProviderConfig } from '../../config/subscriptions.js';
import type { OAuthStartState, OAuthTokenPayload } from '../../../client-auth/oauth-types.js';
export type { OAuthStartState, OAuthTokenPayload } from '../../../client-auth/oauth-types.js';
export declare function createOAuthState(bytes?: number): string;
export declare function createPkceVerifier(bytes?: number): string;
export declare function createPkceChallenge(verifier: string): Promise<string>;
export declare function parseOAuthScopes(raw: unknown): readonly string[] | undefined;
export declare function buildOAuthAuthorizationStart(config: OAuthProviderConfig, input?: {
    readonly state?: string | undefined;
    readonly verifier?: string | undefined;
    readonly redirectUri?: string | undefined;
}): Promise<OAuthStartState>;
/**
 * A token endpoint that ANSWERED, with a non-ok status. Distinguishable from
 * transport failures (which throw plain fetch errors) so a caller can tell
 * "the authorization server refused this grant" (4xx: the session is dead,
 * re-login) from "the authorization server is unreachable or broken" (5xx or
 * no answer: the session's state is unknown, do not tell the user to
 * re-login).
 */
export declare class OAuthTokenExchangeError extends Error {
    readonly status: number;
    constructor(message: string, status: number);
}
export declare function exchangeOAuthAuthorizationCode(config: OAuthProviderConfig, input: {
    readonly code: string;
    readonly verifier: string;
    readonly redirectUri: string;
    readonly state?: string | undefined;
}): Promise<OAuthTokenPayload>;
export declare function refreshOAuthAccessToken(config: OAuthProviderConfig, refreshToken: string): Promise<OAuthTokenPayload>;
export declare function decodeJwtPayload(token: string): Record<string, unknown> | null;
//# sourceMappingURL=oauth-core.d.ts.map