/**
 * @module
 *
 * Provides {@link OIDCMultipleFlows}, a composite OIDC flow that aggregates multiple
 * individual flows (e.g. Authorization Code, Client Credentials, Device Authorization)
 * behind a single token endpoint, token verification method, and OpenID Connect
 * discovery document.
 *
 * Grant type dispatch: `token()` inspects the incoming request and delegates to the
 * first flow that accepts it. Refresh token and token verification are tried against
 * all registered flows in order.
 *
 * The order of flows passed to the constructor matters: the first flow able to
 * handle a request wins.
 */
import { OAuth2FlowTokenResponse } from "../grants/flow.js";
import { StrategyResult } from "../strategy.js";
import { OIDCFlow } from "./types.js";
/**
 * Aggregates multiple OIDC flows into a single handler that exposes a unified
 * token endpoint, token verification, and OpenID Connect discovery document.
 *
 * @template TFlow - The concrete OIDC flow type. Defaults to {@link OIDCFlow}.
 *
 * @example
 * ```ts
 * const flows = new OIDCMultipleFlows({
 *   securitySchemeName: "oidc",
 *   discoveryUrl: "/.well-known/openid-configuration",
 *   flows: [authorizationCodeFlow, clientCredentialsFlow],
 * });
 * ```
 */
export declare class OIDCMultipleFlows<TFlow extends OIDCFlow = OIDCFlow> {
    protected flows: TFlow[];
    protected discoveryUrl: string;
    protected openidConfiguration: Record<string, string | string[] | undefined>;
    protected tokenEndpoint: string;
    protected jwksEndpoint: string;
    protected securitySchemeName: string;
    protected description?: string;
    /**
     * Creates a new `OIDCMultipleFlows` instance.
     *
     * @param options.flows - Ordered list of OIDC flows to delegate to.
     * @param options.discoveryUrl - URL of the OpenID Connect discovery document
     *   (e.g. `"/.well-known/openid-configuration"`).
     * @param options.securitySchemeName - Name of the OpenAPI security scheme entry.
     * @param options.jwksEndpoint - URL of the JWKS endpoint. Defaults to `"/jwks"`.
     * @param options.tokenEndpoint - URL of the token endpoint. Defaults to `"/token"`.
     * @param options.openidConfiguration - Optional overrides merged into the discovery document.
     * @param options.description - Optional human-readable description for the OpenAPI security scheme.
     */
    constructor({ flows, discoveryUrl, jwksEndpoint, openidConfiguration, tokenEndpoint, securitySchemeName, description, }: {
        flows: TFlow[];
        discoveryUrl: string;
        jwksEndpoint?: string;
        tokenEndpoint?: string;
        openidConfiguration?: Record<string, string | string[] | undefined>;
        securitySchemeName: string;
        description?: string;
    });
    /**
     * Returns the URL of the OpenID Connect discovery document.
     */
    getDiscoveryUrl(): string;
    /**
     * Returns the OpenAPI security scheme name for this set of flows.
     */
    getSecuritySchemeName(): string;
    /**
     * Returns the optional human-readable description for the OpenAPI security scheme.
     */
    getDescription(): string | undefined;
    /**
     * Returns the URL of the token endpoint.
     */
    getTokenEndpoint(): string;
    /**
     * Returns the URL of the JWKS endpoint.
     */
    getJwksEndpoint(): string;
    /**
     * Handles an incoming token request by trying each registered flow in order.
     * The first flow that returns a successful result is used.
     * If no flow succeeds, returns a combined error from all flows.
     *
     * @param request - The incoming token endpoint HTTP request.
     * @returns The token response from the first matching flow, or a failure with all errors.
     */
    token(request: Request): Promise<OAuth2FlowTokenResponse>;
    /**
     * Verifies an access token by trying each registered flow in order.
     * The first flow that successfully verifies the token is used.
     * If no flow succeeds, returns a combined error from all flows.
     *
     * @param request - The incoming HTTP request containing the `Authorization` header.
     * @returns The strategy result from the first flow that accepts the token, or a failure.
     */
    verifyToken(request: Request): Promise<StrategyResult>;
    /**
     * Returns the OpenAPI path item security requirement object for this set of flows.
     *
     * @param scopes - Optional list of required scopes.
     * @returns An object keyed by the security scheme name with the required scopes.
     */
    toOpenAPIPathItem(scopes?: string[]): Record<string, string[]>;
    /**
     * Returns the OpenAPI security scheme definition for this set of flows.
     * Uses the `openIdConnect` scheme type pointing to the discovery URL.
     *
     * @returns An object keyed by the security scheme name with the scheme definition.
     */
    toOpenAPISecurityScheme(): Record<string, {
        type: "openIdConnect";
        description?: string;
        openIdConnectUrl: string;
    }>;
    /**
     * Retrieves the OpenID Connect discovery configuration by merging the configurations
     * of all registered flows. Array-valued fields (e.g. `grant_types_supported`) are
     * merged and deduplicated. Static overrides set via `openidConfiguration` take
     * precedence over flow-derived values.
     *
     * @param req - Optional request object used to determine the full base URL for
     *   resolving relative endpoint paths. If omitted, the origin is derived from
     *   `discoveryUrl`.
     * @returns The merged OpenID Connect discovery document.
     * @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
     */
    getDiscoveryConfiguration(req?: Request): Record<string, string | string[] | undefined>;
}
//# sourceMappingURL=oidc_multiple_flows.d.ts.map