import * as z from 'zod/mini';
declare const AuthorizationServerMetadata: z.ZodMiniObject<{
    issuer: z.ZodMiniURL;
    device_authorization_endpoint: z.ZodMiniURL;
    token_endpoint: z.ZodMiniURL;
    revocation_endpoint: z.ZodMiniURL;
    jwks_uri: z.ZodMiniURL;
    introspection_endpoint: z.ZodMiniURL;
}, z.core.$strip>;
export type AuthorizationServerMetadata = z.infer<typeof AuthorizationServerMetadata>;
declare const IntrospectionResponse: z.ZodMiniObject<{
    active: z.ZodMiniBoolean<boolean>;
    client_id: z.ZodMiniOptional<z.ZodMiniString<string>>;
    session_id: z.ZodMiniOptional<z.ZodMiniString<string>>;
}, z.core.$strip>;
export declare function OAuth(config: {
    issuer: URL;
    clientId: string;
    userAgent: string;
}): {
    init(): Promise<{
        as: {
            issuer: string;
            device_authorization_endpoint: string;
            token_endpoint: string;
            revocation_endpoint: string;
            jwks_uri: string;
            introspection_endpoint: string;
        };
        init(): Promise</*elided*/ any>;
        /**
         * Returns the Authorization Server Metadata
         *
         * @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationRequest
         * @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse
         */
        authorizationServerMetadata(): Promise<AuthorizationServerMetadata>;
        /**
         * Perform the Device Authorization Request
         *
         * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.1
         * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.2
         */
        deviceAuthorizationRequest(): Promise<{
            /** The device verification code. */
            device_code: string;
            /** The end-user verification code. */
            user_code: string;
            /**
             * The minimum amount of time in seconds that the client
             * SHOULD wait between polling requests to the token endpoint.
             */
            interval: number;
            /** The end-user verification URI on the authorization server. */
            verification_uri: string;
            /**
             * The end-user verification URI on the authorization server,
             * including the `user_code`, without redirection.
             */
            verification_uri_complete: string;
            /**
             * The absolute lifetime of the `device_code` and `user_code`.
             * Calculated from `expires_in`.
             */
            expiresAt: number;
        }>;
        /**
         * Perform the Device Access Token Request
         *
         * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.4
         */
        deviceAccessTokenRequest(device_code: string): Promise<[Error] | [null, Response]>;
        /**
         * Process the Token request Response
         *
         * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.5
         */
        processTokenResponse(response: Response): Promise<[OAuthError] | [null, TokenSet]>;
        /**
         * Perform a Token Revocation Request.
         *
         * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.1
         * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.2
         */
        revokeToken(token: string): Promise<OAuthError | undefined>;
        /**
         * Perform Refresh Token Request.
         *
         * @see https://datatracker.ietf.org/doc/html/rfc6749#section-6
         */
        refreshToken(token: string): Promise<TokenSet>;
        /**
         * Perform Token Introspection Request.
         *
         * @see https://datatracker.ietf.org/doc/html/rfc7662#section-2.1
         */
        introspectToken(token: string): Promise<z.infer<typeof IntrospectionResponse>>;
    }>;
    /**
     * Returns the Authorization Server Metadata
     *
     * @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationRequest
     * @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse
     */
    authorizationServerMetadata(): Promise<AuthorizationServerMetadata>;
    /**
     * Perform the Device Authorization Request
     *
     * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.1
     * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.2
     */
    deviceAuthorizationRequest(): Promise<{
        /** The device verification code. */
        device_code: string;
        /** The end-user verification code. */
        user_code: string;
        /**
         * The minimum amount of time in seconds that the client
         * SHOULD wait between polling requests to the token endpoint.
         */
        interval: number;
        /** The end-user verification URI on the authorization server. */
        verification_uri: string;
        /**
         * The end-user verification URI on the authorization server,
         * including the `user_code`, without redirection.
         */
        verification_uri_complete: string;
        /**
         * The absolute lifetime of the `device_code` and `user_code`.
         * Calculated from `expires_in`.
         */
        expiresAt: number;
    }>;
    /**
     * Perform the Device Access Token Request
     *
     * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.4
     */
    deviceAccessTokenRequest(device_code: string): Promise<[Error] | [null, Response]>;
    /**
     * Process the Token request Response
     *
     * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.5
     */
    processTokenResponse(response: Response): Promise<[OAuthError] | [null, TokenSet]>;
    /**
     * Perform a Token Revocation Request.
     *
     * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.1
     * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.2
     */
    revokeToken(token: string): Promise<OAuthError | undefined>;
    /**
     * Perform Refresh Token Request.
     *
     * @see https://datatracker.ietf.org/doc/html/rfc6749#section-6
     */
    refreshToken(token: string): Promise<TokenSet>;
    /**
     * Perform Token Introspection Request.
     *
     * @see https://datatracker.ietf.org/doc/html/rfc7662#section-2.1
     */
    introspectToken(token: string): Promise<z.infer<typeof IntrospectionResponse>>;
};
export type OAuth = ReturnType<typeof OAuth>;
declare const TokenSet: z.ZodMiniObject<{
    /** The access token issued by the authorization server. */
    access_token: z.ZodMiniString<string>;
    /** The type of the token issued */
    token_type: z.ZodMiniLiteral<"Bearer">;
    /** The lifetime in seconds of the access token. */
    expires_in: z.ZodMiniNumber<number>;
    /** The refresh token, which can be used to obtain new access tokens. */
    refresh_token: z.ZodMiniOptional<z.ZodMiniString<string>>;
    /** The scope of the access token. */
    scope: z.ZodMiniOptional<z.ZodMiniString<string>>;
}, z.core.$strip>;
type TokenSet = z.infer<typeof TokenSet>;
declare const OAuthErrorResponse: z.ZodMiniObject<{
    error: z.ZodMiniEnum<{
        invalid_request: "invalid_request";
        invalid_client: "invalid_client";
        invalid_grant: "invalid_grant";
        unauthorized_client: "unauthorized_client";
        unsupported_grant_type: "unsupported_grant_type";
        invalid_scope: "invalid_scope";
        server_error: "server_error";
        authorization_pending: "authorization_pending";
        slow_down: "slow_down";
        access_denied: "access_denied";
        expired_token: "expired_token";
        unsupported_token_type: "unsupported_token_type";
    }>;
    error_description: z.ZodMiniOptional<z.ZodMiniString<string>>;
    error_uri: z.ZodMiniOptional<z.ZodMiniString<string>>;
}, z.core.$strip>;
type OAuthErrorResponse = z.infer<typeof OAuthErrorResponse>;
declare class OAuthError extends Error {
    name: string;
    code: OAuthErrorResponse['error'];
    cause: Error;
    constructor(message: string, response: unknown);
}
export declare function isOAuthError(error: unknown): error is OAuthError;
export {};