/**
 * @module oidc_client_credentials
 * @description OpenID Connect extension of the Client Credentials grant flow.
 * Adds OIDC discovery document generation and `openIdConnect` security scheme
 * support to the base {@link AbstractClientCredentialsFlow}.
 * Note: the Client Credentials flow is machine-to-machine and does not involve
 * end-user authentication, so ID tokens and UserInfo endpoints are typically not used.
 */
import { AbstractClientCredentialsFlow, ClientCredentialsFlowOptions } from "../grants/client_credentials.js";
import { OIDCFlow, OIDCFlowExtendedOptions } from "./types.js";
/**
 * Configuration options for the OIDC Client Credentials flow.
 * Combines the base client credentials options with OIDC-specific options
 * such as the discovery URL, optional JWKS endpoint, and static OpenID configuration overrides.
 */
export interface OIDCClientCredentialsFlowOptions extends ClientCredentialsFlowOptions, OIDCFlowExtendedOptions {
}
/**
 * OpenID Connect Client Credentials flow implementation.
 *
 * Extends {@link AbstractClientCredentialsFlow} with OIDC capabilities:
 * - Generates an OIDC discovery document via `getDiscoveryConfiguration()`.
 * - Implements `toOpenAPISecurityScheme()` with the `openIdConnect` scheme type.
 *
 * Because the Client Credentials grant is purely machine-to-machine, this flow
 * does not issue ID tokens or expose a UserInfo endpoint. The discovery document
 * is provided for completeness and interoperability with OIDC-aware clients.
 */
export declare class OIDCClientCredentialsFlow extends AbstractClientCredentialsFlow implements OIDCFlow {
    protected discoveryUrl: string;
    protected jwksEndpoint?: string;
    protected openIdConfiguration?: Record<string, string | string[] | undefined>;
    /**
     * Creates a new `OIDCClientCredentialsFlow` instance.
     * @param options - Configuration options including the discovery URL and optional JWKS endpoint.
     */
    constructor(options: OIDCClientCredentialsFlowOptions);
    /**
     * Returns the OIDC discovery document URL (the `/.well-known/openid-configuration` endpoint).
     * @returns The discovery URL as configured.
     */
    getDiscoveryUrl(): string;
    /**
     * Returns the JWKS endpoint URL used for token validation, if configured.
     * May be an absolute URL or a relative path resolved against the discovery URL's origin.
     * @returns The JWKS endpoint URL, or `undefined` if not set.
     */
    getJwksEndpoint(): string | undefined;
    /**
     * Returns any static OpenID Connect configuration overrides that will be merged into
     * the discovery document produced by {@link getDiscoveryConfiguration}.
     * @returns The static OpenID configuration map, or `undefined` if none was provided.
     */
    getOpenIdConfiguration(): Record<string, string | string[] | undefined> | undefined;
    /**
     * Returns the OpenAPI security scheme descriptor for this flow using the
     * `openIdConnect` scheme type, referencing the discovery URL.
     * @returns A record keyed by the security scheme name.
     */
    toOpenAPISecurityScheme(): Record<string, {
        type: "openIdConnect";
        description?: string;
        openIdConnectUrl: string;
    }>;
    /**
     * Retrieves the OpenID Connect discovery configuration document.
     *
     * Builds the standard provider metadata fields from the flow's configuration and
     * merges in any static overrides set via `openIdConfiguration`. Relative endpoint
     * URLs are resolved against the request's origin (or the discovery URL's origin if
     * no request is provided).
     *
     * @param req - Optional request used to determine the full base URL for relative endpoints.
     * @returns The OpenID Connect discovery document fields.
     * @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
     */
    getDiscoveryConfiguration(req?: Request): Record<string, string | string[] | undefined>;
}
//# sourceMappingURL=oidc_client_credentials.d.ts.map