import { type OIDCProviderConfig, type AuthorizationUrlResult, type TokenExchangeRequest, type TokenExchangeResult, type TokenRefreshResult, type OIDCUserInfo, type SSOErrorCode } from './types.js';
/**
 * OIDC-specific error class
 */
export declare class OIDCError extends Error {
    code: SSOErrorCode;
    providerId?: string;
    originalError?: Error;
    details?: Record<string, unknown>;
    constructor(message: string, code: SSOErrorCode, options?: {
        providerId?: string;
        originalError?: Error;
        details?: Record<string, unknown>;
    });
}
/**
 * OIDC Provider - handles authentication flows for a single provider
 *
 * Uses dynamic imports to work with ESM-only openid-client v6 in a CommonJS environment.
 *
 * @example
 * ```typescript
 * const provider = new OIDCProvider(config);
 * await provider.initialize();
 *
 * // Generate authorization URL
 * const { url, state } = await provider.generateAuthorizationUrl({
 *   returnUrl: '/dashboard'
 * });
 *
 * // After callback, exchange code for tokens
 * const result = await provider.exchangeCode({
 *   code: callbackCode,
 *   state: callbackState,
 *   storedState: savedState
 * });
 * ```
 */
export declare class OIDCProvider {
    private readonly config;
    private discoveredConfig;
    private initialized;
    private initializePromise;
    constructor(config: OIDCProviderConfig);
    /**
     * Get the provider configuration
     */
    getConfig(): Readonly<OIDCProviderConfig>;
    /**
     * Get the provider ID
     */
    get id(): string;
    /**
     * Check if the provider is enabled
     */
    get enabled(): boolean;
    /**
     * Initialize the provider by performing OIDC discovery
     */
    initialize(cacheTtlSeconds?: number): Promise<void>;
    /**
     * Perform OIDC discovery
     */
    private performDiscovery;
    /**
     * Ensure provider is initialized before operations
     */
    private ensureInitialized;
    /**
     * Generate PKCE code verifier and challenge
     */
    private generatePKCE;
    /**
     * Generate a random state parameter
     */
    private generateState;
    /**
     * Generate a random nonce
     */
    private generateNonce;
    /**
     * Generate authorization URL for initiating login
     */
    generateAuthorizationUrl(options?: {
        returnUrl?: string;
        tenantId?: string;
        metadata?: Record<string, unknown>;
        stateExpirationSeconds?: number;
    }): Promise<AuthorizationUrlResult>;
    /**
     * Exchange authorization code for tokens
     */
    exchangeCode(request: TokenExchangeRequest): Promise<TokenExchangeResult>;
    /**
     * Refresh access token using refresh token
     */
    refreshTokens(refreshToken: string): Promise<TokenRefreshResult>;
    /**
     * Revoke a token (access or refresh)
     */
    revokeToken(token: string, tokenTypeHint?: 'access_token' | 'refresh_token'): Promise<void>;
    /**
     * Fetch user info from the userinfo endpoint
     */
    fetchUserInfo(accessToken: string, expectedSubject?: string): Promise<OIDCUserInfo>;
    /**
     * Generate logout URL for RP-initiated logout
     */
    generateLogoutUrl(options?: {
        idToken?: string;
        postLogoutRedirectUri?: string;
        state?: string;
    }): string | null;
    /**
     * Extract token set from openid-client response
     */
    private extractTokenSet;
    /**
     * Parse ID token claims (basic decode without cryptographic verification)
     * Note: openid-client v6 validates the ID token during authorizationCodeGrant
     */
    private parseIdToken;
    /**
     * Clear discovery cache for this provider
     */
    clearCache(): void;
}
/**
 * Create and initialize an OIDC provider
 */
export declare function createOIDCProvider(config: OIDCProviderConfig, options?: {
    cacheTtlSeconds?: number;
}): Promise<OIDCProvider>;
/**
 * Clear all discovery caches
 */
export declare function clearAllDiscoveryCaches(): void;
//# sourceMappingURL=oidc-provider.d.ts.map