/**
 * Client ID Metadata Documents (CIMD).
 *
 * The final MCP 2026-07-28 authorization spec **deprecates Dynamic Client
 * Registration (DCR)** in favor of CIMD: a client uses an HTTPS URL as its
 * `client_id`, and that URL resolves to a JSON document describing the client
 * (redirect URIs, grant types, etc.). Authorization servers fetch and cache the
 * document instead of running a registration endpoint.
 *
 * This module provides:
 * - a publisher that serves a client's own metadata document at a stable URL, and
 * - a resolver that fetches and validates a client's CIMD URL.
 *
 * DCR remains available on the legacy path and as an opt-in; CIMD is the
 * recommended mechanism on 2026-07-28.
 *
 * @module
 */
/**
 * A Client ID Metadata Document (OAuth client metadata, RFC 7591 shape).
 * The `client_id` MUST equal the HTTPS URL the document is served from.
 */
export interface ClientIdMetadataDocument {
    /** The HTTPS URL this document is published at (also the OAuth `client_id`). */
    client_id: string;
    client_name?: string;
    redirect_uris: string[];
    grant_types?: string[];
    response_types?: string[];
    token_endpoint_auth_method?: string;
    scope?: string;
    application_type?: 'web' | 'native';
    logo_uri?: string;
    client_uri?: string;
    contacts?: string[];
    [key: string]: unknown;
}
/**
 * Strict validation of a Client Identifier URL per draft-ietf-oauth-client-id-metadata-document-02 §2.
 */
export declare function validateClientIdentifierUrl(urlStr: string, allowLoopback?: boolean): URL;
/**
 * Build a Client ID Metadata Document for this client.
 *
 * @param clientIdUrl - The HTTPS URL the document will be served from. Becomes
 *   the `client_id`.
 */
export declare function createClientIdMetadataDocument(clientIdUrl: string, metadata: {
    redirect_uris: string[];
} & Partial<Omit<ClientIdMetadataDocument, 'client_id' | 'redirect_uris'>>, options?: {
    allowLoopback?: boolean;
}): ClientIdMetadataDocument;
/**
 * Validate that a resolved document is a well-formed CIMD whose `client_id`
 * matches the URL it was fetched from (prevents impersonation).
 */
export declare function validateClientIdMetadataDocument(doc: unknown, sourceUrl: string): ClientIdMetadataDocument;
import dns from 'dns/promises';
/**
 * Checks whether an IPv4 or IPv6 address belongs to RFC 6890 special-use or private ranges.
 */
export declare function isSpecialUseIp(ip: string): boolean;
/**
 * Asserts that a target URL does not resolve to an RFC 6890 special-use or private IP address.
 */
export declare function assertSafeFetchTarget(urlStr: string, allowLoopback?: boolean, dnsLookupImpl?: typeof dns.lookup): Promise<void>;
export declare const MAX_CIMD_DOCUMENT_BYTES = 5120;
/**
 * Reads response body up to maxBytes, throwing if exceeded.
 */
export declare function readBoundedJson<T = unknown>(response: Response, maxBytes?: number): Promise<T>;
export declare const DEFAULT_CIMD_FETCH_TIMEOUT_MS = 5000;
/**
 * Resolve a client's CIMD by fetching its `client_id` URL and validating it.
 * Authorization servers call this in place of a DCR lookup.
 */
export declare function resolveClientIdMetadataDocument(clientIdUrl: string, options?: {
    fetchImpl?: typeof fetch;
    allowLoopback?: boolean;
    dnsLookupImpl?: typeof dns.lookup;
    maxDocumentBytes?: number;
    timeoutMs?: number;
    signal?: AbortSignal;
}): Promise<ClientIdMetadataDocument>;
/**
 * Whether a string looks like a CIMD-style client id (a valid HTTP/HTTPS URL) rather
 * than an opaque DCR-issued id.
 */
export declare function isClientIdMetadataUrl(clientId: string): boolean;
//# sourceMappingURL=cimd.d.ts.map