/**
 * RFC 9728 Protected Resource Metadata.
 *
 * TypeScript parity port of python/runtime/metadata.py.
 *
 * Provides the discovery document AI clients use to locate the AuthSec
 * authorization server and learn which scopes the resource server supports.
 */
import type { Config } from './config.js';
export declare const PROTECTED_RESOURCE_PREFIX = "/.well-known/oauth-protected-resource";
/**
 * Compute the RFC 9728 metadata path for the given resource URI (or
 * already-stripped path).
 *
 * Accepts either a full URI (``https://mcp.example.com/mcp``) or just the
 * path component (``/mcp`` or ``mcp``). Returns:
 *
 *   - ``/.well-known/oauth-protected-resource``           (root resources)
 *   - ``/.well-known/oauth-protected-resource/mcp``       (path-based)
 */
export declare function buildResourceMetadataPath(protectedPath: string): string;
/** Absolute URL of the metadata document for ``resourceUri``. */
export declare function buildResourceMetadataUrl(resourceUri: string): string;
/**
 * True iff ``requestPath`` is the metadata discovery path for ``resourceUri``.
 * Path-based resources match only their derived alias; root resources match
 * the bare well-known path.
 */
export declare function isMetadataRequest(resourceUri: string, requestPath: string): boolean;
/**
 * Construct the JSON-able metadata payload (RFC 9728).
 *
 * The ``scopes_supported`` field is sourced in this order:
 *  1. ``authoritativeScopes`` (if non-null) — the live list pulled from
 *     AuthSec via the scope matrix. **This is the canonical source.**
 *     Admin changes a scope in the AuthSec UI → SDK refreshes the matrix
 *     → PRM auto-updates. No code change in the MCP server.
 *  2. ``cfg.supportedScopes`` — local fallback for boot-time PRM requests
 *     before the scope matrix has been fetched, or for ``policyMode=local_only``
 *     deployments that intentionally manage scopes locally.
 *
 * Always pass ``authoritativeScopes`` from the runtime when one is available.
 */
export declare function buildMetadataPayload(cfg: Config, authoritativeScopes?: string[] | null): Record<string, unknown>;
export interface WwwAuthenticateOptions {
    realm?: string;
    error?: string;
    errorDescription?: string;
    scope?: string;
    resourceMetadataUrl?: string;
}
/**
 * Build the ``WWW-Authenticate`` header value for a 401/403 response. Always
 * includes ``Bearer realm`` and ``resource_metadata`` (RFC 9728). Optionally
 * includes ``error`` and ``error_description`` for insufficient_scope /
 * invalid_token responses.
 *
 * Overloads:
 *  - ``buildWwwAuthenticate(cfg, { error, errorDescription, scope })``
 *  - ``buildWwwAuthenticate(realm, error, errorDescription)`` (Python-shape positional form)
 */
export declare function buildWwwAuthenticate(cfgOrRealm: Config | string, errorOrOptions?: string | WwwAuthenticateOptions, errorDescription?: string): string;
/**
 * Return [body, headers] for a 200 OK metadata response.
 *
 * Pass ``authoritativeScopes`` from ``runtime.getAuthoritativeScopes()`` so
 * the PRM advertises the live AuthSec scope list. When omitted (or ``null``),
 * falls back to ``cfg.supportedScopes`` so legacy callers keep working.
 */
export declare function metadataJsonResponse(cfg: Config, authoritativeScopes?: string[] | null): {
    body: string;
    headers: Record<string, string>;
};
//# sourceMappingURL=metadata.d.ts.map