/**
 * OAuth 2.1 Flow Utilities
 *
 * Provides utilities for building OAuth authorization and token requests
 * with support for:
 * - PKCE (RFC 7636)
 * - Resource Parameters (RFC 8707) - MCP 2025-11-25
 * - Standard OAuth 2.1 flows
 */
import { TokenResponse } from '../types/token.js';
/**
 * Authorization Request Parameters
 */
export interface AuthorizationRequestParams {
    /** Authorization endpoint URL */
    authorizationEndpoint: string;
    /** Client identifier */
    clientId: string;
    /** Redirect URI for callback */
    redirectUri: string;
    /** Requested scope (space-separated) */
    scope: string;
    /** State parameter for CSRF protection */
    state: string;
    /** Code challenge derived from code verifier */
    codeChallenge: string;
    /** Code challenge method: 'S256' or 'plain' */
    codeChallengeMethod: 'S256' | 'plain';
    /** Nonce for OpenID Connect */
    nonce?: string;
    /** Resource parameter (RFC 8707) - MCP 2025-11-25 */
    resource?: string;
    /** Additional custom parameters */
    additionalParams?: Record<string, string>;
}
/**
 * Token Request Parameters
 */
export interface TokenRequestParams {
    /** Token endpoint URL */
    tokenEndpoint: string;
    /** Client identifier */
    clientId: string;
    /** Authorization code from callback */
    code: string;
    /** Redirect URI (must match authorization request) */
    redirectUri: string;
    /** Code verifier for PKCE */
    codeVerifier: string;
    /** Client secret (for confidential clients) */
    clientSecret?: string;
    /** Use private_key_jwt authentication instead of client_secret */
    usePrivateKeyJWT?: boolean;
    /** JWT assertion for private_key_jwt authentication */
    clientAssertion?: string;
    /** Resource parameter (should match authorization request) */
    resource?: string;
    /** Additional custom parameters */
    additionalParams?: Record<string, string>;
}
/**
 * Build authorization URL for OAuth 2.1 flow
 *
 * @param params - Authorization request parameters
 * @returns Complete authorization URL
 */
export declare function buildAuthorizationUrl(params: AuthorizationRequestParams): string;
/**
 * Exchange authorization code for access token
 *
 * @param params - Token request parameters
 * @returns Token response
 */
export declare function exchangeCodeForToken(params: TokenRequestParams): Promise<TokenResponse>;
/**
 * Refresh access token using refresh token
 *
 * @param tokenEndpoint - Token endpoint URL
 * @param clientId - Client identifier
 * @param refreshToken - Refresh token
 * @param clientSecret - Client secret (optional)
 * @param scope - Requested scope (optional, defaults to original)
 * @param resource - Resource parameter (RFC 8707)
 * @returns Token response
 */
export declare function refreshAccessToken(tokenEndpoint: string, clientId: string, refreshToken: string, clientSecret?: string, scope?: string, resource?: string): Promise<TokenResponse>;
/**
 * Parse authorization callback parameters
 *
 * @param callbackUrl - The callback URL with query parameters
 * @returns Parsed parameters including code, state, and any errors
 */
export declare function parseAuthorizationCallback(callbackUrl: string): {
    code?: string;
    state?: string;
    error?: string;
    error_description?: string;
    error_uri?: string;
};
/**
 * Validate state parameter matches expected value
 *
 * @param receivedState - State from callback
 * @param expectedState - Expected state value
 * @throws Error if state doesn't match
 */
export declare function validateState(receivedState: string | undefined, expectedState: string): void;
/**
 * Token Request Error
 */
export declare class TokenRequestError extends Error {
    status: number;
    response: any;
    validationErrors?: string[] | undefined;
    constructor(message: string, status: number, response: any, validationErrors?: string[] | undefined);
}
//# sourceMappingURL=oauth-flow.d.ts.map