export interface CapturedOAuthAccessTokenClaims {
    iss?: string;
    sub?: string;
    aud?: string | string[];
    exp?: number;
    iat?: number;
    nbf?: number;
    jti?: string;
    client_id?: string;
    scope?: string;
    scp?: string | string[];
    resource?: string | string[];
    authorization_details?: unknown;
    cnf?: {
        jkt?: string;
        jwk?: unknown;
        [key: string]: unknown;
    };
    act?: {
        sub?: string;
        [key: string]: unknown;
    };
    may_act?: {
        sub?: string;
        [key: string]: unknown;
    };
}
export interface CapturedOAuthProtectedResourceMetadata {
    resource?: string;
    authorization_servers?: string[];
    scopes_supported?: string[];
}
export interface CapturedOAuthAuthorizationDetailConstraint {
    type: string;
    actions?: string[];
    locations?: string[];
}
export interface CapturedDpopProofEvidence {
    proofJwt: string;
    method: string;
    url: string;
    expectedAth?: string;
    expectedNonce?: string;
    requiredCnfJkt?: string;
    nowSeconds?: number;
    maxAgeSeconds?: number;
    clockSkewSeconds?: number;
}
export interface CapturedMcpOAuthEvidence {
    protocol: 'mcp_oauth';
    claimsVerified: true;
    claims: CapturedOAuthAccessTokenClaims;
    token_hash?: string;
    protectedResourceMetadata?: CapturedOAuthProtectedResourceMetadata;
    requiredScopes?: string[];
    requiredAuthorizationDetails?: CapturedOAuthAuthorizationDetailConstraint[];
    issuer?: string;
    audience?: string | string[];
    resource?: string;
    expectedSubject?: string;
    expectedClientId?: string;
    expectedActorSubject?: string;
    requiredCnfJkt?: string;
    requireCnf?: boolean;
    dpopProof?: CapturedDpopProofEvidence;
}
export interface McpOAuthEvidenceCaptureOptions {
    requiredScopes?: string[];
    requiredAuthorizationDetails?: CapturedOAuthAuthorizationDetailConstraint[];
    protectedResourceMetadata?: CapturedOAuthProtectedResourceMetadata;
    issuer?: string;
    audience?: string | string[];
    resource?: string;
    expectedSubject?: string;
    expectedClientId?: string;
    expectedActorSubject?: string;
    requiredCnfJkt?: string;
    requireCnf?: boolean;
    claimSource?: 'minimal' | 'extraClaims';
    includeTokenHash?: boolean;
    includeDpopProof?: boolean;
    requestMethod?: string;
    expectedDpopNonce?: string;
    dpopNowSeconds?: number;
    dpopMaxAgeSeconds?: number;
    dpopClockSkewSeconds?: number;
}
interface McpAuthInfoLike {
    token?: string;
    clientId?: string;
    scopes?: string[];
    expiresAt?: number;
    resource?: URL | string;
    extra?: Record<string, unknown>;
}
interface McpRequestInfoLike {
    headers?: unknown;
    url?: URL | string;
}
export interface McpRequestExtraLike {
    authInfo?: McpAuthInfoLike;
    requestInfo?: McpRequestInfoLike;
}
export interface McpOAuthEvidenceCaptureContext {
    serverUrl: string;
}
export declare function buildMcpOAuthEvidenceFromExtra(extra: unknown, capture: boolean | McpOAuthEvidenceCaptureOptions | undefined, context: McpOAuthEvidenceCaptureContext): CapturedMcpOAuthEvidence | undefined;
export {};
//# sourceMappingURL=oauth-evidence.d.ts.map