import { Request, RequestHandler } from 'express';
type StaticTokenSource = {
    type: 'static';
    apiKey: string;
    baseUrl?: string;
};
type DynamicTokenSource = {
    type: 'dynamic';
    getApiKey: (req: Request) => string | undefined;
    baseUrl?: string;
};
type TokenSource = StaticTokenSource | DynamicTokenSource;
type RequireValidTodoistTokenOptions = TokenSource & {
    /**
     * Cache TTL in milliseconds. Defaults to 300_000 (5 minutes) for static,
     * 120_000 (2 minutes) for dynamic.
     */
    cacheTtlMs?: number;
    /**
     * URL for the Protected Resource Metadata document (RFC 9728).
     * Included in the WWW-Authenticate header when returning 401.
     * If omitted, the header is sent without resource_metadata.
     */
    resourceMetadataUrl?: string;
};
/**
 * Express middleware that validates the Todoist API token before MCP processing.
 *
 * Returns HTTP 401 with a spec-compliant WWW-Authenticate header if the token
 * is invalid, allowing MCP clients to trigger OAuth token refresh.
 */
declare function requireValidTodoistToken(options: RequireValidTodoistTokenOptions): RequestHandler;
/**
 * Clear the token validation cache. Useful for testing.
 */
declare function clearTokenValidationCache(): void;
export { clearTokenValidationCache, requireValidTodoistToken, type RequireValidTodoistTokenOptions };
//# sourceMappingURL=require-valid-todoist-token.d.ts.map