/**
 * HTTP client for `auth.cognitum.one`'s OAuth surface (ADR-306): authorize
 * URL construction, `POST /oauth/token` (`authorization_code` and
 * `refresh_token` grants), and `POST /v1/oauth/code-exchange` (OOB fallback).
 *
 * A TypeScript port of meta-proxy's `src/oauth/client.rs`
 * (cognitum-one/meta-proxy) — same base URL, same endpoints, same
 * form/query parameter names, confirmed live 2026-07-16 (a real
 * `GET /oauth/authorize?...&client_id=meta-proxy&redirect_uri=<ruflo-controlled
 * loopback>` returns a working consent page, not a redirect_uri-mismatch
 * error — so this client reuses meta-proxy's registered `client_id` rather
 * than requiring a new one).
 *
 * Deliberately NOT `api.cognitum.one/v1/auth/*` — that's what ruflo's own
 * checked-in OpenAPI spec (v3/docs/api/cognitum-v1.openapi.yaml, ADR-308)
 * describes, but it does not match what the real identity server serves.
 * This client targets the proven, live surface instead.
 *
 * @module v3/security/oauth/client
 */
export declare const CLIENT_ID = "meta-proxy";
export declare const SCOPE = "inference";
/** RFC 8252 out-of-band sentinel — the OOB/manual-paste flow's `redirect_uri`. */
export declare const OOB_REDIRECT_URI = "urn:ietf:wg:oauth:2.0:oob";
export interface TokenResponse {
    access_token: string;
    token_type: string;
    account_email?: string;
    refresh_token?: string;
    expires_in?: number;
}
export declare class OAuthError extends Error {
    readonly code: 'network' | 'protocol' | 'unexpected_shape';
    readonly oauthError?: string | undefined;
    readonly oauthDescription?: string | undefined;
    constructor(message: string, code: 'network' | 'protocol' | 'unexpected_shape', oauthError?: string | undefined, oauthDescription?: string | undefined);
}
/** Builds the `/oauth/authorize` URL for the standard loopback-redirect flow. */
export declare function authorizeUrl(redirectUri: string, state: string, codeChallenge: string): string;
/** `POST /oauth/token` with `grant_type=authorization_code`. */
export declare function exchangeCode(code: string, codeVerifier: string, redirectUri: string, base?: string): Promise<TokenResponse>;
/**
 * `POST /oauth/token` with `grant_type=refresh_token`. identity rotates
 * refresh tokens with reuse detection: presenting a refresh token returns a
 * NEW refresh token and revokes the old one, and re-presenting a spent one
 * revokes the whole session family. Callers MUST persist the returned
 * `refresh_token` atomically before using the new access token, and must
 * never retry a failed refresh with the same token.
 */
export declare function refreshToken(refreshTokenValue: string, base?: string): Promise<TokenResponse>;
/**
 * `POST /v1/oauth/code-exchange` — the OOB manual-entry fallback for
 * headless/SSH/container environments where no browser round-trip to
 * `127.0.0.1` is reachable.
 */
export declare function exchangeManualCode(code: string, codeVerifier: string, base?: string): Promise<TokenResponse>;
//# sourceMappingURL=client.d.ts.map