import { ConfigService } from "@nestjs/config";
/**
 * OAuth Discovery Controller
 *
 * Serves the well-known metadata documents MCP clients use to
 * discover the authorization server and protected resource:
 * - RFC 8414 Authorization Server Metadata
 * - RFC 9728 Protected Resource Metadata
 *
 * Both endpoints are public (no guard) per their RFCs and return
 * plain JSON (not JSON:API) — the RFCs mandate their own wire format.
 */
export declare class OAuthDiscoveryController {
    private readonly configService;
    constructor(configService: ConfigService);
    /**
     * Authorization Server Metadata (RFC 8414)
     *
     * GET /.well-known/oauth-authorization-server
     *
     * Endpoint paths mirror the actual routes registered by
     * OAuthTokenController and OAuthRegistrationController.
     *
     * `authorization_endpoint` deliberately points at the WEB app's consent
     * page (app.url), not the API's Bearer-guarded /oauth/authorize route: a
     * browser navigation carries no Authorization header, so the API route can
     * never authenticate it. The web page handles login, then calls the API's
     * authorize/approve endpoint with the user's JWT and redirects back to the
     * client with the authorization code.
     */
    authorizationServer(): Record<string, unknown>;
    /**
     * Protected Resource Metadata (RFC 9728)
     *
     * GET /.well-known/oauth-protected-resource
     *
     * Consumed by MCP clients to locate the authorization server
     * protecting the /mcp resource.
     */
    protectedResource(): Record<string, unknown>;
    /** API base URL without trailing slash (api.url is normalized to end with one). */
    private baseUrl;
    /** Web-app base URL without trailing slash — hosts the browser-facing consent page. */
    private appBaseUrl;
}
//# sourceMappingURL=oauth.discovery.controller.d.ts.map