import { type BearerTokenResponse, type DeviceAccessTokenError, type DeviceAccessTokenResponse, type DeviceAuthorizationResponse } from "./authorize.ts";
import type { ValidatedAuthMetadata } from "./discover.ts";
import { type OAuthRegistrationRequest } from "./register.ts";
export * from "./authorize.ts";
export * from "./error.ts";
export * from "./register.ts";
export * from "./tokenRefresher.ts";
export * from "./discover.ts";
/**
 * Type representing the persistent context needed for typical OAuth flows
 */
type Context = {
    /** The OAuth client ID */
    clientId: string;
    /** The desired device ID */
    deviceId?: string;
    /** The seed used to generate the challenge code */
    codeVerifier?: string;
    /** The URI to redirect the user to with credentials after auth */
    redirectUri: string;
};
export declare class OAuth2 {
    readonly metadata: ValidatedAuthMetadata;
    /**
     * Attempts dynamic registration against the configured registration endpoint.
     * Will ignore any URIs that do not use client_uri as a common base as per the spec.
     * @param authMetadata - Auth config from {@link MatrixClient.getAuthMetadata}
     * @param clientMetadata - The metadata for the client which to register,
     *     grant_types & response_types & token_endpoint_auth_method will be sanely calculated if omitted.
     * @returns Promise<string> resolved with registered clientId
     * @throws when registration is not supported, on failed request or invalid response
     */
    static registerClient(authMetadata: ValidatedAuthMetadata, clientMetadata: OAuthRegistrationRequest): Promise<string>;
    readonly context: Required<Context>;
    constructor(metadata: ValidatedAuthMetadata, context: Context);
    /**
     * Generate a URL to attempt authorization with the OP
     * See https://spec.matrix.org/v1.18/client-server-api/#authorization-code-flow
     * @param state - A unique opaque identifier, like a transaction ID,
     *     that will allow the client to maintain state between the authorization request and the callback.
     *     The app should use this to key the storage for where the rest of the auth context is saved.
     * @param responseMode - The manner in which the IdP should send the secrets back to the app. Defaults to `fragment` for privacy.
     * @param prompt - Optional prompt parameter to pass to the IdP to signal intent, e.g. `create` for User registration.
     * @param scope - The OAuth2 scope to request, will be generated based on the device ID if omitted.
     * @returns a Promise with the url as a string
     */
    generateAuthorizationCodeGrantUrl(state: string, responseMode?: "fragment" | "query", prompt?: string, scope?: string): Promise<string>;
    /**
     * Attempt to exchange authorization code for bearer token.
     *
     * Takes the authorization code returned by the OAuth2 Provider via the authorization URL, and makes a
     * request to the Token Endpoint, to obtain the access token, refresh token, etc.
     *
     * @param code - authorization code as returned by IdP during authorization
     * @returns a validated bearer token response
     * @throws An `Error` with `message` set to an entry in {@link OAuth2Error},
     *      when the request fails, or the returned token response is invalid.
     */
    completeAuthorizationCodeGrant(code: string): Promise<BearerTokenResponse>;
    /**
     * Refresh the access token using the given refresh token and the refresh token grant
     * @param refreshToken - the token to use to refresh the access token
     */
    performRefreshTokenGrant(refreshToken: string): Promise<BearerTokenResponse>;
    /**
     * Revokes the given token
     * @param token - the token to remove
     * @param type - the type of token, acts as a hint to the IdP
     */
    revokeToken(token: string, type?: "access_token" | "refresh_token"): Promise<void>;
    /**
     * Begin OAuth2 device authorization flow.
     * @param scope - the scope to request for authorization.
     * @returns a promise that resolves to a device access token response,
     *   or an error response if the user denies authorization or the device code expires.
     */
    startDeviceAuthorizationGrant(scope?: string): Promise<DeviceAuthorizationResponse>;
    /**
     * Polls the OAuth2 token endpoint until we get a device access token response, or encounter an unrecoverable error.
     * @param session - The session returned from a previous call to {@link OAuth2.startDeviceAuthorizationGrant}.
     * @returns a promise that resolves to a device access token response,
     *   or an error response if the user denies authorization or the device code expires.
     */
    waitForDeviceAuthorizationGrant(session: DeviceAuthorizationResponse): Promise<DeviceAccessTokenResponse | DeviceAccessTokenError>;
    private fetch;
}
//# sourceMappingURL=index.d.ts.map