/** A random URL-safe ID. 16 bytes = 128 random bits, the floor the spec sets for `jti` (4.2). */
export declare function randomId(prefix?: string, bytes?: number): string;
export declare function sha256b64url(input: string): string;
export declare function nowSeconds(): number;
export declare function sleep(ms: number, signal?: AbortSignal): Promise<void>;
export type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
/** Hosts we treat as "local development" for messages and defaults. */
export declare function isLoopbackHost(hostname: string): boolean;
export interface SecurityOptions {
    /**
     * NON-SPEC. Lets `http:` URLs through every place the spec demands HTTPS (client_id,
     * discovery, issuer, endpoints, redirects). Only for testing against a local dev server.
     */
    insecureDev?: boolean | undefined;
}
/**
 * Parses `value` as an absolute URL and enforces the spec's HTTPS requirement. With
 * `insecureDev`, plain `http:` is tolerated too.
 */
export declare function requireSecureUrl(value: unknown, what: string, sec: SecurityOptions): URL;
/** Strip a single leading `www.` and lowercase, as the spec compares domains (3.1). */
export declare function normalizeDomain(domain: string): string;
/** `Retry-After` as seconds: either delta-seconds or an HTTP-date. */
export declare function parseRetryAfter(value: string | null): number | undefined;
export interface WwwAuthChallenge {
    scheme: string;
    params: Record<string, string>;
}
/**
 * Minimal `WWW-Authenticate` parser: enough for `DPoP error="...", scope="..."` and
 * `Bearer error="..."` (RFC 6750 / RFC 9449). Handles several challenges in one header.
 */
export declare function parseWwwAuthenticate(header: string | null): WwwAuthChallenge[];
/** The first `error` found in any challenge of a `WWW-Authenticate` header. */
export declare function wwwAuthError(header: string | null): {
    error?: string | undefined;
    scope?: string | undefined;
    description?: string | undefined;
};
/** A space-separated scope string as a set (OAuth scope syntax, RFC 6749 3.3). */
export declare function scopeSet(scope: string | undefined): Set<string>;
//# sourceMappingURL=util.d.ts.map