export interface OAuthClientMetadataDocument {
    clientId: string;
    clientName: string;
    redirectUris: string[];
    grantTypes: string[];
    responseTypes: string[];
    tokenEndpointAuthMethod: "none";
    applicationType: "native" | "web";
}
export declare function isUrlBasedOAuthClientId(clientId: string): boolean;
export declare function validateOAuthClientMetadataUrl(clientId: string): URL;
export declare function isAllowedOAuthRedirectUri(value: unknown): value is string;
/**
 * RFC 8252 section 7.3: a native client's loopback redirect URI uses a port
 * chosen at request time, so the authorization server must ignore the port when
 * comparing loopback redirect URIs against the registered set. Non-loopback
 * redirects keep exact matching, so this cannot widen into an open redirect.
 */
export declare function matchesRegisteredRedirectUri(registered: readonly string[], redirectUri: string, applicationType: "native" | "web"): boolean;
export declare function applicationTypeForRedirectUris(redirectUris: string[]): "native" | "web";
export declare function resolveOAuthClientMetadataDocument(clientId: string): Promise<OAuthClientMetadataDocument>;