/**
 * Validate + freeze a client descriptor.
 *
 * @param {ClientConfig} config
 * @returns {Client}
 */
export function defineClient(config: ClientConfig): Client;
/**
 * @typedef {Object} ClientRegistry
 * @property {(clientId: string) => (Client | undefined) | Promise<Client | undefined>} getClient
 */
/**
 * Build an in-memory registry from a static client list.
 *
 * @param {ClientConfig[]} clients
 * @returns {ClientRegistry}
 */
export function createClientRegistry(clients: ClientConfig[]): ClientRegistry;
/**
 * Accept either a ready registry (an object with `getClient`) or a static
 * client list and return a registry.
 *
 * @param {ClientRegistry | ClientConfig[]} clientsOrRegistry
 * @returns {ClientRegistry}
 */
export function resolveRegistry(clientsOrRegistry: ClientRegistry | ClientConfig[]): ClientRegistry;
/**
 * Token-endpoint client-authentication methods this server understands
 * (RFC 6749 §2.3, RFC 7523, RFC 8705). `none` is a public client
 * (RFC 6749 §2.1) — allowed only because PKCE is mandatory, so a public
 * client is still protected against code interception.
 */
export const AUTH_METHODS: readonly string[];
export type ClientRegistry = {
    getClient: (clientId: string) => (Client | undefined) | Promise<Client | undefined>;
};
export type ClientConfig = {
    clientId: string;
    /**
     * confidential clients only
     */
    clientSecret?: string | undefined;
    /**
     * exact-match allowlist (RFC 6749 §3.1.2)
     */
    redirectUris: string[];
    /**
     * default `['authorization_code','refresh_token']`
     */
    grantTypes?: string[] | undefined;
    /**
     * default `['code']`
     */
    responseTypes?: string[] | undefined;
    /**
     * one of {@link AUTH_METHODS}
     */
    tokenEndpointAuthMethod?: string | undefined;
    /**
     * scopes the client may request (omit = server default)
     */
    scope?: string[] | undefined;
    /**
     * for `private_key_jwt` / signed request objects
     */
    jwksUri?: string | undefined;
    /**
     * inline JWKS alternative to `jwksUri`
     */
    jwks?: object | undefined;
    /**
     * require DPoP for this client (RFC 9449 §5.2)
     */
    dpopBoundAccessTokens?: boolean | undefined;
    /**
     * require PAR (RFC 9126 §2)
     */
    requirePushedAuthorizationRequests?: boolean | undefined;
    /**
     * expected cert subject DN for `tls_client_auth` (RFC 8705 §2.1)
     */
    tlsClientAuthSubjectDn?: string | undefined;
    /**
     * base64url `x5t#S256` for `self_signed_tls_client_auth` (RFC 8705 §2.2)
     */
    certificateThumbprint?: string | undefined;
};
export type Client = Readonly<ClientConfig & {
    grantTypes: string[];
    responseTypes: string[];
    tokenEndpointAuthMethod: string;
    isPublic: boolean;
}>;