import { OAuth2Client, OAuth2Tokens } from "arctic";
/**
 * Extends arctic's `OAuth2Client` so we own the token-endpoint exchange. We
 * support both `client_secret_basic` (HTTP Basic) and `client_secret_post`
 * (credentials in form body), and always surface the upstream response body in
 * thrown errors — arctic discards it, which makes diagnosing `invalid_client`
 * from providers like JumpCloud nearly impossible.
 */
export type TokenEndpointAuthMethod = "client_secret_basic" | "client_secret_post";
export declare class ExtendedOAuth2Client extends OAuth2Client {
    private readonly _clientId;
    private readonly _clientPassword;
    private readonly _redirectURI;
    private readonly tokenEndpointAuthMethod;
    constructor(clientId: string, clientPassword: string | null, redirectURI: string | null, tokenEndpointAuthMethod?: TokenEndpointAuthMethod);
    validateAuthorizationCode(tokenEndpoint: string, code: string, codeVerifier: string | null): Promise<OAuth2Tokens>;
}
