/**
 * OpenID Connect (OIDC) client for Motor Authorization Beacon
 *
 * @packageDocumentation
 */
import type { OIDCConfiguration, OIDCAuthorizationRequest, OIDCAuthorizationResponse, OIDCTokenResponse, OIDCUserInfo, JWKS, MotorServiceWorkerConfig } from './types.js';
/**
 * OIDC client configuration
 */
export interface OIDCClientConfig extends MotorServiceWorkerConfig {
    /** Client ID for OIDC */
    client_id: string;
    /** Redirect URI for authorization callback */
    redirect_uri: string;
    /** Client secret (for confidential clients) */
    client_secret?: string;
    /** Requested scopes */
    scope?: string;
    /** Response type */
    response_type?: string;
    /** Use PKCE for authorization code flow */
    use_pkce?: boolean;
    /** Auto-refresh tokens */
    auto_refresh?: boolean;
}
/**
 * OIDC Authorization client for Motor
 */
export declare class OIDCClient {
    private readonly baseUrl;
    private readonly config;
    private discoveryCache?;
    private accessToken?;
    private refreshToken?;
    private idToken?;
    private tokenExpiresAt?;
    private codeVerifier?;
    private codeChallenge?;
    constructor(config: OIDCClientConfig);
    /**
     * Make an API request
     */
    private request;
    /**
     * Get OIDC discovery configuration
     */
    getConfiguration(): Promise<OIDCConfiguration>;
    /**
     * Generate PKCE code verifier and challenge
     */
    private generatePKCE;
    /**
     * Generate random string for state/nonce/PKCE
     */
    private generateRandomString;
    /**
     * Base64 URL encode
     */
    private base64UrlEncode;
    /**
     * Build authorization URL
     */
    buildAuthorizationUrl(options?: Partial<OIDCAuthorizationRequest>): Promise<string>;
    /**
     * Start authorization flow
     */
    authorize(options?: Partial<OIDCAuthorizationRequest>): Promise<void>;
    /**
     * Open authorization in popup
     */
    authorizePopup(options?: Partial<OIDCAuthorizationRequest>): Promise<OIDCAuthorizationResponse>;
    /**
     * Parse authorization response from URL
     */
    private parseAuthorizationResponse;
    /**
     * Handle authorization callback
     */
    handleCallback(url?: string): Promise<OIDCTokenResponse>;
    /**
     * Exchange authorization code for tokens
     */
    exchangeCode(code: string): Promise<OIDCTokenResponse>;
    /**
     * Refresh access token
     */
    refreshAccessToken(): Promise<OIDCTokenResponse>;
    /**
     * Get user information
     */
    getUserInfo(): Promise<OIDCUserInfo>;
    /**
     * Get JSON Web Key Set
     */
    getJWKS(): Promise<JWKS>;
    /**
     * Logout / revoke tokens
     */
    logout(): Promise<void>;
    /**
     * Check if token is expired
     */
    isTokenExpired(): boolean;
    /**
     * Get current access token
     */
    getAccessToken(): string | undefined;
    /**
     * Get current ID token
     */
    getIdToken(): string | undefined;
    /**
     * Get current refresh token
     */
    getRefreshToken(): string | undefined;
    /**
     * Set tokens manually (for testing or restoration)
     */
    setTokens(tokens: {
        access_token?: string;
        refresh_token?: string;
        id_token?: string;
        expires_in?: number;
    }): void;
}
/**
 * Create an OIDC client
 */
export declare function createOIDCClient(config: OIDCClientConfig): OIDCClient;
/**
 * Check if we're on a callback URL
 */
export declare function isOIDCCallback(redirectUri: string): boolean;
/**
 * Auto-handle OIDC callback if on callback URL
 */
export declare function autoHandleOIDCCallback(client: OIDCClient, redirectUri: string, onSuccess?: (tokens: OIDCTokenResponse) => void, onError?: (error: Error) => void): Promise<void>;
//# sourceMappingURL=oidc.d.ts.map