/**
 * OAuth 2.1 Bearer token validation middleware for Streamable HTTP.
 *
 * Validates `Authorization: Bearer <token>` headers on incoming requests
 * against a `JWTIssuer`. On missing or invalid token it writes a 401
 * with `WWW-Authenticate: Bearer resource_metadata="..."` per RFC 6750 +
 * RFC 9728 (OAuth 2.1 protected resource metadata discovery).
 *
 * Success attaches the validated claims to `AuthenticatedRequest.user` so
 * downstream handlers can read the subject without re-validating.
 */
import type { IncomingMessage, ServerResponse } from 'node:http';
import type { JWTIssuer } from '../oauth/jwt-issuer.js';
export interface OAuthMiddlewareOptions {
    jwtIssuer: JWTIssuer;
    resourceMetadataUrl: string;
    /**
     * When `true`, skip Bearer token validation and attach an anonymous user
     * claim. Intended for deployments behind an external auth boundary
     * (reverse proxy, API gateway like agentgateway/Zitadel) where the caller
     * has already verified identity. Logs a warning on construction; the
     * deployer is responsible for ensuring upstream auth is in place.
     */
    authDisabled?: boolean;
}
export interface AuthenticatedRequest extends IncomingMessage {
    user?: Record<string, unknown>;
}
export declare function extractBearerToken(authHeader: string | undefined): string | null;
export declare class OAuthMiddleware {
    private readonly _issuer;
    private readonly _resourceMetadataUrl;
    private readonly _authDisabled;
    constructor(options: OAuthMiddlewareOptions);
    /**
     * Validate the request. Returns `true` if the request should proceed
     * (and attaches `req.user` on success). Returns `false` if the
     * middleware has already written a 401 response.
     *
     * When constructed with `authDisabled: true`, this short-circuits to
     * `true` and attaches `{ sub: 'anonymous', anonymous: true }` to `req.user`.
     */
    validate(req: AuthenticatedRequest, res: ServerResponse): Promise<boolean>;
}
//# sourceMappingURL=oauth-middleware.d.ts.map