/**
 * MCP Dynamic Client Registration (RFC 7591)
 *
 * Implements POST /oauth/mcp/register. MCP clients (Claude Desktop, Cursor,
 * mcp-remote) register at runtime with no pre-baked client_id; the registry
 * persists their issued client_id so it survives Harper restarts.
 *
 * Defaults applied here reflect the MCP authorization spec 2025-06-18: public
 * clients (token_endpoint_auth_method=none), authorization_code + refresh_token
 * grants, response_type=code. Confidential clients can opt in explicitly.
 */
import type { Logger, MCPConfig } from '../../types.ts';
/**
 * Handle POST /oauth/mcp/register. RFC 7591 §3 returns 201 with the issued
 * client_id (and client_secret for confidential clients) plus echoed metadata.
 *
 * @param request - HTTP request (only used for the Authorization header today)
 * @param body - Parsed JSON request body
 * @param mcpConfig - Plugin MCP configuration
 * @param logger - Optional logger
 */
/**
 * DCR is enabled by the PRESENCE of the `dynamicClientRegistration` config
 * block (and not switched off by `enabled: false`). An absent block means the
 * endpoint does not exist — "I never configured registration" must mean there
 * IS no registration. The pre-#182 default (absent block ⇒ open, ungated
 * registration) silently exposed unauthenticated client creation on every
 * deployment that had no reason to touch this block; CIMD is the forward path
 * for client identity and needs no DCR at all. Exported so the well-known
 * metadata advertises `registration_endpoint` under exactly this predicate.
 */
export declare function dcrEnabled(mcpConfig: MCPConfig | undefined): boolean;
export declare function handleRegister(request: {
    headers?: {
        authorization?: string;
    };
} | undefined, body: any, mcpConfig: MCPConfig | undefined, logger?: Logger): Promise<any>;