import { Key, Keyset } from '@atproto/jwk';
import { type OAuthClientIdDiscoverable, type OAuthClientMetadata, type OAuthClientMetadataInput, type OAuthResponseMode } from '@atproto/oauth-types';
import { type AtprotoDid, type DidCache } from '@atproto-labs/did-resolver';
import type { Fetch } from '@atproto-labs/fetch';
import type { HandleCache, HandleResolver } from '@atproto-labs/handle-resolver';
import { type CreateIdentityResolverOptions } from './identity-resolver.js';
import { type AuthorizationServerMetadataCache } from './oauth-authorization-server-metadata-resolver.js';
import { type ProtectedResourceMetadataCache } from './oauth-protected-resource-metadata-resolver.js';
import { OAuthResolver } from './oauth-resolver.js';
import type { DpopNonceCache, OAuthServerAgent } from './oauth-server-agent.js';
import { OAuthServerFactory } from './oauth-server-factory.js';
import { OAuthSession } from './oauth-session.js';
import type { RuntimeImplementation } from './runtime-implementation.js';
import { Runtime } from './runtime.js';
import { SessionGetter, type SessionGetterOptions, type SessionStore } from './session-getter.js';
import type { InternalStateData, StateStore } from './state-store.js';
import type { AuthorizeOptions, CallbackOptions, ClientMetadata } from './types.js';
export type { AuthorizationServerMetadataCache, CreateIdentityResolverOptions, DidCache, DpopNonceCache, Fetch, HandleCache, HandleResolver, InternalStateData, OAuthClientMetadata, OAuthClientMetadataInput, OAuthResponseMode, ProtectedResourceMetadataCache, RuntimeImplementation, SessionGetterOptions, SessionStore, StateStore, };
export { Key, Keyset };
export type OAuthClientOptions = {
    responseMode: OAuthResponseMode;
    clientMetadata: Readonly<OAuthClientMetadataInput>;
    keyset?: Keyset | Iterable<Key | undefined | null | false>;
    /**
     * Determines if the client will allow communicating with the OAuth Servers
     * (Authorization & Resource), or to retrieve "did:web" documents, over
     * unsafe HTTP connections. It is recommended to set this to `true` only for
     * development purposes.
     *
     * @note This does not affect the identity resolution mechanism, which will
     * allow HTTP connections to the PLC Directory (if the provided directory url
     * is "http:" based).
     * @default false
     * @see {@link OAuthProtectedResourceMetadataResolver.allowHttpResource}
     * @see {@link OAuthAuthorizationServerMetadataResolver.allowHttpIssuer}
     * @see {@link DidResolverCommonOptions.allowHttp}
     */
    allowHttp?: boolean;
    stateStore: StateStore;
    sessionStore: SessionStore;
    authorizationServerMetadataCache?: AuthorizationServerMetadataCache;
    protectedResourceMetadataCache?: ProtectedResourceMetadataCache;
    dpopNonceCache?: DpopNonceCache;
    runtimeImplementation: RuntimeImplementation;
    fetch?: Fetch;
} & CreateIdentityResolverOptions & SessionGetterOptions;
export type OAuthClientFetchMetadataOptions = {
    clientId: OAuthClientIdDiscoverable;
    fetch?: Fetch;
    signal?: AbortSignal;
};
export declare class OAuthClient {
    static fetchMetadata({ clientId, fetch, signal, }: OAuthClientFetchMetadataOptions): Promise<{
        redirect_uris: ["http://127.0.0.1" | `${string}.${string}:/${string}` | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `https://${string}`, ...("http://127.0.0.1" | `${string}.${string}:/${string}` | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `https://${string}`)[]];
        response_types: ["code" | "code id_token" | "code id_token token" | "code token" | "id_token" | "id_token token" | "none" | "token", ...("code" | "code id_token" | "code id_token token" | "code token" | "id_token" | "id_token token" | "none" | "token")[]];
        grant_types: ["authorization_code" | "client_credentials" | "implicit" | "password" | "refresh_token" | "urn:ietf:params:oauth:grant-type:jwt-bearer" | "urn:ietf:params:oauth:grant-type:saml2-bearer", ...("authorization_code" | "client_credentials" | "implicit" | "password" | "refresh_token" | "urn:ietf:params:oauth:grant-type:jwt-bearer" | "urn:ietf:params:oauth:grant-type:saml2-bearer")[]];
        scope?: string | undefined;
        token_endpoint_auth_method: "client_secret_basic" | "client_secret_jwt" | "client_secret_post" | "none" | "private_key_jwt" | "self_signed_tls_client_auth" | "tls_client_auth";
        token_endpoint_auth_signing_alg?: string | undefined;
        userinfo_signed_response_alg?: string | undefined;
        userinfo_encrypted_response_alg?: string | undefined;
        jwks_uri?: "http://127.0.0.1" | "http://localhost" | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `http://localhost#${string}` | `http://localhost/${string}` | `http://localhost:${string}` | `http://localhost?${string}` | `https://${string}` | undefined;
        jwks?: {
            keys: ((({
                kid?: string | undefined;
                use?: "enc" | "sig" | undefined;
                key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
                x5c?: string[] | undefined;
                x5t?: string | undefined;
                'x5t#S256'?: string | undefined;
                x5u?: string | undefined;
                ext?: boolean | undefined;
                iat?: number | undefined;
                exp?: number | undefined;
                nbf?: number | undefined;
                revoked?: {
                    revoked_at: number;
                    reason?: string | undefined;
                } | undefined;
                kty: "RSA";
                alg?: "PS256" | "PS384" | "PS512" | "RS256" | "RS384" | "RS512" | undefined;
                n: string;
                e: string;
                d?: string | undefined;
                p?: string | undefined;
                q?: string | undefined;
                dp?: string | undefined;
                dq?: string | undefined;
                qi?: string | undefined;
                oth?: {
                    r?: string | undefined;
                    d?: string | undefined;
                    t?: string | undefined;
                }[] | undefined;
            } & {
                kid: NonNullable<unknown>;
            }) | ({
                kid?: string | undefined;
                use?: "enc" | "sig" | undefined;
                key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
                x5c?: string[] | undefined;
                x5t?: string | undefined;
                'x5t#S256'?: string | undefined;
                x5u?: string | undefined;
                ext?: boolean | undefined;
                iat?: number | undefined;
                exp?: number | undefined;
                nbf?: number | undefined;
                revoked?: {
                    revoked_at: number;
                    reason?: string | undefined;
                } | undefined;
                kty: "EC";
                alg?: "ES256" | "ES384" | "ES512" | undefined;
                crv: "P-256" | "P-384" | "P-521";
                x: string;
                y: string;
                d?: string | undefined;
            } & {
                kid: NonNullable<unknown>;
            }) | ({
                kid?: string | undefined;
                use?: "enc" | "sig" | undefined;
                key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
                x5c?: string[] | undefined;
                x5t?: string | undefined;
                'x5t#S256'?: string | undefined;
                x5u?: string | undefined;
                ext?: boolean | undefined;
                iat?: number | undefined;
                exp?: number | undefined;
                nbf?: number | undefined;
                revoked?: {
                    revoked_at: number;
                    reason?: string | undefined;
                } | undefined;
                kty: "EC";
                alg?: "ES256K" | undefined;
                crv: "secp256k1";
                x: string;
                y: string;
                d?: string | undefined;
            } & {
                kid: NonNullable<unknown>;
            }) | ({
                kid?: string | undefined;
                use?: "enc" | "sig" | undefined;
                key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
                x5c?: string[] | undefined;
                x5t?: string | undefined;
                'x5t#S256'?: string | undefined;
                x5u?: string | undefined;
                ext?: boolean | undefined;
                iat?: number | undefined;
                exp?: number | undefined;
                nbf?: number | undefined;
                revoked?: {
                    revoked_at: number;
                    reason?: string | undefined;
                } | undefined;
                kty: "OKP";
                alg?: "EdDSA" | undefined;
                crv: "Ed25519" | "Ed448";
                x: string;
                d?: string | undefined;
            } & {
                kid: NonNullable<unknown>;
            })) & {
                d?: never;
            })[];
        } | undefined;
        application_type: "native" | "web";
        subject_type: "pairwise" | "public";
        request_object_signing_alg?: string | undefined;
        id_token_signed_response_alg?: string | undefined;
        authorization_signed_response_alg: string;
        authorization_encrypted_response_enc?: "A128CBC-HS256" | undefined;
        authorization_encrypted_response_alg?: string | undefined;
        client_id?: string | undefined;
        client_name?: string | undefined;
        client_uri?: "http://127.0.0.1" | "http://localhost" | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `http://localhost#${string}` | `http://localhost/${string}` | `http://localhost:${string}` | `http://localhost?${string}` | `https://${string}` | undefined;
        policy_uri?: "http://127.0.0.1" | "http://localhost" | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `http://localhost#${string}` | `http://localhost/${string}` | `http://localhost:${string}` | `http://localhost?${string}` | `https://${string}` | undefined;
        tos_uri?: "http://127.0.0.1" | "http://localhost" | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `http://localhost#${string}` | `http://localhost/${string}` | `http://localhost:${string}` | `http://localhost?${string}` | `https://${string}` | undefined;
        logo_uri?: "http://127.0.0.1" | "http://localhost" | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `http://localhost#${string}` | `http://localhost/${string}` | `http://localhost:${string}` | `http://localhost?${string}` | `https://${string}` | undefined;
        default_max_age?: number | undefined;
        require_auth_time?: boolean | undefined;
        contacts?: string[] | undefined;
        tls_client_certificate_bound_access_tokens?: boolean | undefined;
        dpop_bound_access_tokens?: boolean | undefined;
        authorization_details_types?: string[] | undefined;
    }>;
    readonly clientMetadata: ClientMetadata;
    readonly responseMode: OAuthResponseMode;
    readonly keyset?: Keyset;
    readonly runtime: Runtime;
    readonly fetch: Fetch;
    readonly oauthResolver: OAuthResolver;
    readonly serverFactory: OAuthServerFactory;
    protected readonly sessionGetter: SessionGetter;
    protected readonly stateStore: StateStore;
    constructor(options: OAuthClientOptions);
    get identityResolver(): import("@atproto-labs/identity-resolver").IdentityResolver;
    get jwks(): Readonly<{
        keys: readonly (Readonly<{
            kid?: string | undefined;
            use?: "enc" | "sig" | undefined;
            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
            x5c?: string[] | undefined;
            x5t?: string | undefined;
            'x5t#S256'?: string | undefined;
            x5u?: string | undefined;
            ext?: boolean | undefined;
            iat?: number | undefined;
            exp?: number | undefined;
            nbf?: number | undefined;
            revoked?: {
                revoked_at: number;
                reason?: string | undefined;
            } | undefined;
            kty: "RSA";
            alg?: "PS256" | "PS384" | "PS512" | "RS256" | "RS384" | "RS512" | undefined;
            n: string;
            e: string;
            d?: string | undefined;
            p?: string | undefined;
            q?: string | undefined;
            dp?: string | undefined;
            dq?: string | undefined;
            qi?: string | undefined;
            oth?: {
                r?: string | undefined;
                d?: string | undefined;
                t?: string | undefined;
            }[] | undefined;
        } & {
            kid: NonNullable<unknown>;
        } & {
            d?: never;
        }> | Readonly<{
            kid?: string | undefined;
            use?: "enc" | "sig" | undefined;
            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
            x5c?: string[] | undefined;
            x5t?: string | undefined;
            'x5t#S256'?: string | undefined;
            x5u?: string | undefined;
            ext?: boolean | undefined;
            iat?: number | undefined;
            exp?: number | undefined;
            nbf?: number | undefined;
            revoked?: {
                revoked_at: number;
                reason?: string | undefined;
            } | undefined;
            kty: "EC";
            alg?: "ES256" | "ES384" | "ES512" | undefined;
            crv: "P-256" | "P-384" | "P-521";
            x: string;
            y: string;
            d?: string | undefined;
        } & {
            kid: NonNullable<unknown>;
        } & {
            d?: never;
        }> | Readonly<{
            kid?: string | undefined;
            use?: "enc" | "sig" | undefined;
            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
            x5c?: string[] | undefined;
            x5t?: string | undefined;
            'x5t#S256'?: string | undefined;
            x5u?: string | undefined;
            ext?: boolean | undefined;
            iat?: number | undefined;
            exp?: number | undefined;
            nbf?: number | undefined;
            revoked?: {
                revoked_at: number;
                reason?: string | undefined;
            } | undefined;
            kty: "EC";
            alg?: "ES256K" | undefined;
            crv: "secp256k1";
            x: string;
            y: string;
            d?: string | undefined;
        } & {
            kid: NonNullable<unknown>;
        } & {
            d?: never;
        }> | Readonly<{
            kid?: string | undefined;
            use?: "enc" | "sig" | undefined;
            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
            x5c?: string[] | undefined;
            x5t?: string | undefined;
            'x5t#S256'?: string | undefined;
            x5u?: string | undefined;
            ext?: boolean | undefined;
            iat?: number | undefined;
            exp?: number | undefined;
            nbf?: number | undefined;
            revoked?: {
                revoked_at: number;
                reason?: string | undefined;
            } | undefined;
            kty: "OKP";
            alg?: "EdDSA" | undefined;
            crv: "Ed25519" | "Ed448";
            x: string;
            d?: string | undefined;
        } & {
            kid: NonNullable<unknown>;
        } & {
            d?: never;
        }>)[];
    }>;
    authorize(input: string, { signal, ...options }?: AuthorizeOptions): Promise<URL>;
    /**
     * This method allows the client to proactively revoke the request_uri it
     * created through PAR.
     */
    abortRequest(authorizeUrl: URL): Promise<void>;
    callback(params: URLSearchParams, options?: CallbackOptions): Promise<{
        session: OAuthSession;
        state: string | null;
    }>;
    /**
     * Load a stored session. This will refresh the token only if needed (about to
     * expire) by default.
     *
     * @see {@link SessionGetter.restore}
     */
    restore(sub: string, refresh?: boolean | 'auto'): Promise<OAuthSession>;
    revoke(sub: string): Promise<void>;
    protected createSession(server: OAuthServerAgent, sub: AtprotoDid): OAuthSession;
}
//# sourceMappingURL=oauth-client.d.ts.map