import { ProtectedResourceMetadata } from './types.js';
/**
 * Protected Resource Metadata (RFC 9728)
 *
 * MCP servers MUST implement this to advertise their authorization servers
 * to MCP clients. This enables automatic discovery of auth configuration.
 */
/**
 * Create protected resource metadata document
 *
 * @param resourceUri - The URI of this MCP server
 * @param authorizationServers - Array of authorization server issuer URLs
 * @param scopesSupported - Optional: scopes this resource supports
 */
export declare function createProtectedResourceMetadata(resourceUri: string, authorizationServers: string[], scopesSupported?: string[]): ProtectedResourceMetadata;
/**
 * Get well-known URI for protected resource metadata
 * Per RFC 9728, can be at:
 * 1. Resource path: /.well-known/oauth-protected-resource{path}
 * 2. Root: /.well-known/oauth-protected-resource
 *
 * SEP-2351 audit: for path-component issuers the `.well-known` segment is
 * inserted between the origin and the issuer path (not appended after it),
 * which is exactly what this function does. The client-side discovery in
 * `client.ts#discoverAuthorizationServer` follows the same insertion rule.
 */
export declare function getWellKnownMetadataUris(resourceUrl: URL): string[];
/**
 * Generate WWW-Authenticate header value for 401 responses
 * Per RFC 6750 and MCP spec
 *
 * @param resourceMetadataUrl - URL to protected resource metadata
 * @param scope - Optional: required scopes for this request
 * @param error - Optional: error code (invalid_token, insufficient_scope, etc.)
 * @param errorDescription - Optional: human-readable error description
 */
export declare function generateWWWAuthenticateHeader(options: {
    resourceMetadataUrl?: string;
    scope?: string;
    error?: string;
    errorDescription?: string;
    realm?: string;
}): string;
/**
 * Parse WWW-Authenticate header
 * Extracts Bearer auth challenge parameters
 */
export declare function parseWWWAuthenticateHeader(headerValue: string): {
    scheme: string;
    realm?: string;
    scope?: string;
    resourceMetadata?: string;
    error?: string;
    errorDescription?: string;
} | null;
//# sourceMappingURL=server-metadata.d.ts.map