import type { Guard } from './guard.interface.js';
import type { ExecutionContext } from '../types.js';
/**
 * OAuth Token Payload Interface
 *
 * Standard OAuth 2.1 / JWT claims (RFC 9068)
 */
export interface OAuthTokenPayload {
    /** Subject - typically the user ID */
    sub: string;
    /** Issuer - the authorization server that issued the token */
    iss?: string;
    /** Audience - who the token is intended for (RFC 8707) */
    aud?: string | string[];
    /** Expiration time (Unix timestamp) */
    exp?: number;
    /** Issued at time (Unix timestamp) */
    iat?: number;
    /** Not before time (Unix timestamp) */
    nbf?: number;
    /** JWT ID - unique identifier for the token */
    jti?: string;
    /** Scopes - permissions granted to the token */
    scope?: string;
    scopes?: string[];
    /** Client ID that requested the token */
    client_id?: string;
    /** Custom claims */
    [key: string]: unknown;
}
/**
 * Built-in Standard OAuth 2.1 Guard
 */
export declare class OAuthGuard implements Guard {
    canActivate(context: ExecutionContext): Promise<boolean>;
    private extractScopes;
}
/**
 * Scope Guard Factory
 */
export declare function createScopeGuard(requiredScopes: string[]): new () => Guard;
//# sourceMappingURL=oauth.guard.d.ts.map