import { ProtectedResourceMetadata, AuthorizationServerMetadata, ClientRegistrationRequest, ClientRegistrationResponse, TokenResponse, McpAuthClientConfig } from './types.js';
import { PKCEParams } from './pkce.js';
/**
 * OAuth 2.1 Client for MCP
 *
 * Handles:
 * - Protected Resource Metadata discovery (RFC 9728)
 * - Authorization Server Metadata discovery (RFC 8414)
 * - Dynamic Client Registration (RFC 7591)
 * - Authorization Code Flow with PKCE (OAuth 2.1)
 * - Token refresh and revocation
 */
export declare class OAuth2Client {
    private config;
    constructor(config: McpAuthClientConfig);
    /**
     * Discover Protected Resource Metadata (RFC 9728)
     *
     * Tries:
     * 1. WWW-Authenticate header from 401 response
     * 2. Well-known URI at resource path
     * 3. Well-known URI at root
     *
     * @param resourceUrl - URL of the MCP server
     */
    discoverProtectedResourceMetadata(resourceUrl: string): Promise<ProtectedResourceMetadata>;
    /**
     * Discover Authorization Server Metadata (RFC 8414)
     *
     * Supports both:
     * - OAuth 2.0 Authorization Server Metadata (RFC 8414)
     * - OpenID Connect Discovery 1.0
     *
     * @param issuer - Authorization server issuer URL
     */
    discoverAuthorizationServerMetadata(issuer: string): Promise<AuthorizationServerMetadata>;
    /**
     * Register client dynamically (RFC 7591)
     *
     * @param registrationEndpoint - Client registration endpoint
     * @param metadata - Client metadata
     */
    registerClient(registrationEndpoint: string, metadata: ClientRegistrationRequest): Promise<ClientRegistrationResponse>;
    /**
     * Start authorization flow
     *
     * Generates authorization URL with PKCE parameters
     *
     * @param authzEndpoint - Authorization endpoint
     * @param clientId - OAuth client ID
     * @param redirectUri - Redirect URI
     * @param scope - Requested scopes
     * @param resource - Resource indicator (RFC 8707)
     * @returns Authorization URL and PKCE parameters (store for token exchange)
     */
    startAuthorizationFlow(options: {
        authorizationEndpoint: string;
        clientId: string;
        redirectUri: string;
        scope?: string;
        resource?: string;
        state?: string;
        /**
         * OIDC `prompt` value (SEP-2207). Set to `consent` when an OpenID Connect
         * authorization server requires re-consent to issue a refresh token
         * (typically alongside the `offline_access` scope).
         */
        prompt?: string;
    }): Promise<{
        authUrl: string;
        state: string;
        pkce: PKCEParams;
    }>;
    /**
     * Exchange authorization code for access token
     *
     * @param code - Authorization code from callback
     * @param pkce - PKCE parameters from startAuthorizationFlow
     * @param tokenEndpoint - Token endpoint
     * @param clientId - OAuth client ID
     * @param clientSecret - OAuth client secret (for confidential clients)
     * @param redirectUri - Redirect URI (must match authorization request)
     * @param resource - Resource indicator (RFC 8707)
     */
    exchangeCodeForToken(options: {
        code: string;
        pkce: PKCEParams;
        tokenEndpoint: string;
        clientId: string;
        clientSecret?: string;
        redirectUri: string;
        resource?: string;
    }): Promise<TokenResponse>;
    /**
     * Refresh access token
     *
     * @param refreshToken - Refresh token
     * @param tokenEndpoint - Token endpoint
     * @param clientId - OAuth client ID
     * @param clientSecret - OAuth client secret
     * @param scope - Optional: request different scopes
     * @param resource - Resource indicator (RFC 8707)
     */
    refreshToken(options: {
        refreshToken: string;
        tokenEndpoint: string;
        clientId: string;
        clientSecret?: string;
        scope?: string;
        resource?: string;
    }): Promise<TokenResponse>;
    /**
     * Get client credentials token (for server-to-server)
     *
     * @param tokenEndpoint - Token endpoint
     * @param clientId - OAuth client ID
     * @param clientSecret - OAuth client secret
     * @param scope - Requested scopes
     * @param resource - Resource indicator (RFC 8707)
     */
    getClientCredentialsToken(options: {
        tokenEndpoint: string;
        clientId: string;
        clientSecret: string;
        scope?: string;
        resource?: string;
    }): Promise<TokenResponse>;
    /**
     * Revoke token (access or refresh)
     *
     * @param token - Token to revoke
     * @param revocationEndpoint - Revocation endpoint
     * @param clientId - OAuth client ID
     * @param clientSecret - OAuth client secret
     * @param tokenTypeHint - 'access_token' or 'refresh_token'
     */
    revokeToken(options: {
        token: string;
        revocationEndpoint: string;
        clientId: string;
        clientSecret?: string;
        tokenTypeHint?: 'access_token' | 'refresh_token';
    }): Promise<void>;
    /**
     * Make token request
     */
    private tokenRequest;
    /**
     * Fetch metadata from URL
     */
    private fetchMetadata;
    /**
     * Generate random state for CSRF protection
     */
    private generateState;
    /**
     * Whether a redirect URI targets loopback (localhost / 127.0.0.1 / [::1]),
     * used to infer `application_type: 'native'` for DCR (SEP-837).
     */
    static isLoopbackRedirect(uri: string): boolean;
    /**
     * Validate the issuer returned on an authorization response (RFC 9207 /
     * SEP-2468). MCP 2026-07-28 clients MUST verify the `iss` parameter on the
     * authorization redirect matches the authorization server's issuer to defend
     * against mix-up attacks. Throws on mismatch.
     *
     * @param receivedIss - `iss` query parameter from the authorization redirect.
     * @param expectedIssuer - Issuer from the AS metadata used to start the flow.
     */
    static validateAuthorizationIssuer(receivedIss: string | undefined | null, expectedIssuer: string): void;
}
//# sourceMappingURL=client.d.ts.map