/**
 * EVO-12 P2 (mode 3, gateway broker) — upstream OIDC Relying Party for 39-auth.
 *
 * The hosted shim keeps the DCR + token surface claude.ai needs (self-AS), but
 * delegates the USER login to 39-auth (the sentropic OIDC IdP, live at
 * `…/api/v1/auth/oauth/authorize`): redirect to its `/authorize`, then exchange
 * the code at `/token` and read the authenticated `sub`. The `sub` is what the
 * gateway maps to a per-user h2a root (multi-tenant).
 *
 * Pure + fetch-injected → unit-testable against a mock IdP. The real client
 * (client_id/secret) is seeded operator-side in 39-auth (no DCR there); that
 * seed is the live-integration point, not a code dependency.
 */
export interface H2AUpstreamOidcConfig {
    /** 39-auth issuer (informational / id_token `iss` check later). */
    readonly issuer: string;
    /** 39-auth authorization endpoint (e.g. …/api/v1/auth/oauth/authorize). */
    readonly authorizeUrl: string;
    /** 39-auth token endpoint (e.g. …/api/v1/auth/oauth/token). */
    readonly tokenUrl: string;
    /** This gateway's seeded client id at 39-auth. */
    readonly clientId: string;
    /** This gateway's client secret (k8s Secret). */
    readonly clientSecret: string;
    /** The gateway's callback URL registered at 39-auth. */
    readonly redirectUri: string;
    /** Scopes to request (openid required for `sub`). */
    readonly scopes: readonly string[];
}
/** Minimal fetch shape (injected for tests; global fetch satisfies it). */
export type UpstreamFetch = (url: string, init: {
    method: string;
    headers: Record<string, string>;
    body: string;
}) => Promise<{
    ok: boolean;
    status: number;
    json: () => Promise<unknown>;
}>;
export interface UpstreamLogin {
    /** The authenticated user — the gateway's per-tenant key. */
    readonly sub: string;
    readonly idToken: string;
    readonly accessToken?: string;
}
/** Build the 39-auth `/authorize` URL to redirect the user to (authorization_code + PKCE). */
export declare function buildUpstreamAuthorizeUrl(config: H2AUpstreamOidcConfig, params: {
    state: string;
    codeChallenge: string;
}): string;
/** Exchange an authorization_code (+ PKCE verifier) at 39-auth for the user's `sub`. */
export declare function exchangeUpstreamCode(config: H2AUpstreamOidcConfig, params: {
    code: string;
    codeVerifier: string;
}, fetchImpl: UpstreamFetch): Promise<UpstreamLogin>;
//# sourceMappingURL=oidc-rp.d.ts.map