/**
 * @module
 *
 * Implements the OAuth 2.0 Client Credentials grant type.
 *
 * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.4
 */
import { ClientAuthMethod } from "../client_auth_methods/types.js";
import { TokenTypeValidationResponse } from "../token_types/types.js";
import type { OAuth2Client } from "../types.js";
import { OAuth2Flow, type OAuth2FlowOptions, type OAuth2FlowTokenResponse, type OAuth2GrantModel } from "./flow.js";
/**
 * Handles the Client Credentials grant type.
 *
 * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.4
 */
export interface ClientCredentialsGrant {
    /** The grant type identifier. */
    readonly grantType: "client_credentials";
}
/**
 * Validation context for client credentials grant,
 * which can be used by the model's generateAccessToken() method
 * to generate tokens with appropriate scope, lifetimes, etc.
 */
export interface ClientCredentialsGrantContext {
    /** The authenticated client. */
    client: OAuth2Client;
    /** The grant type identifier. Always `"client_credentials"`. */
    grantType: string;
    /** The validated scopes granted to the client for this token. */
    scope: string[];
    /** The token type prefix (e.g. `"Bearer"`, `"DPoP"`). */
    tokenType: string;
    /** The access token lifetime in seconds. */
    accessTokenLifetime: number;
    /** The origin of the request, used for validation and security purposes. */
    origin: string;
    /** The result of the token type validation. */
    tokenTypeValidation: TokenTypeValidationResponse;
}
/**
 * Raw token request parameters for client credentials grant.
 */
export interface ClientCredentialsTokenRequest {
    /** The client identifier extracted from the request. */
    clientId: string;
    /** The client secret extracted from the request. */
    clientSecret: string;
    /** The grant type value from the request body. Should be `"client_credentials"`. */
    grantType: string;
    /** The origin of the request, used for validation and security purposes. */
    origin: string;
    /** The result of the token type validation. */
    tokenTypeValidation: TokenTypeValidationResponse;
    /** The client authentication method used for this request, if any. */
    clientAuthMethod?: string | undefined;
    /** The client authentication data extracted from the request, if any. */
    clientAuthData?: Partial<OAuth2Client> | undefined;
    /** The requested scopes, if provided in the request body. */
    scope?: string[];
}
/**
 * Model interface that must be implemented by the consuming application
 * to provide persistence for clients and tokens related to the client credentials grant.
 */
export interface ClientCredentialsModel extends OAuth2GrantModel<ClientCredentialsTokenRequest, ClientCredentialsGrantContext> {
}
/**
 * Options for configuring the client credentials grant flow.
 */
export interface ClientCredentialsFlowOptions extends OAuth2FlowOptions {
    model: ClientCredentialsModel;
}
/**
 * Abstract base class for the Client Credentials flow.
 *
 * Provides the full `token()` request handling pipeline - content type parsing,
 * grant type validation, client authentication, scope validation, and token generation.
 * Subclasses must implement `toOpenAPISecurityScheme()`.
 *
 * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.4
 */
export declare abstract class AbstractClientCredentialsFlow extends OAuth2Flow implements ClientCredentialsGrant {
    readonly grantType: "client_credentials";
    protected readonly model: ClientCredentialsModel;
    constructor(options: ClientCredentialsFlowOptions);
    protected addClientAuthenticationMethod(value: "client_secret_basic" | "client_secret_post" | "none" | ClientAuthMethod): this;
    /**
     * Handles a token request for the client credentials grant type.
     * Validates the client credentials and generates an access token if valid.
     * Returns an appropriate error response if validation fails.
     *
     * @param request - The incoming HTTP request.
     * @returns A token response with the generated access token, or a failure with an error.
     */
    token(request: Request): Promise<OAuth2FlowTokenResponse>;
}
/**
 * Concrete Client Credentials flow implementation.
 *
 * Extends {@link AbstractClientCredentialsFlow} with an OpenAPI security scheme
 * definition for the `clientCredentials` OAuth 2.0 flow type.
 *
 * @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.4
 */
export declare class ClientCredentialsFlow extends AbstractClientCredentialsFlow {
    /**
     * Returns the OpenAPI security scheme definition for this flow.
     * Uses the `oauth2` scheme type with a `clientCredentials` flow.
     *
     * @returns An object keyed by the security scheme name with the scheme definition.
     */
    toOpenAPISecurityScheme(): Record<string, {
        type: "oauth2";
        description?: string;
        flows: {
            clientCredentials: {
                scopes: Record<string, string>;
                tokenUrl: string;
            };
        };
    }>;
}
//# sourceMappingURL=client_credentials.d.ts.map