import { Clock, JwtSigner, Result, FederationError, ValidatedTrustChain, EntityId, FederationKeyProvider, ParsedEntityStatement, TrustAnchorSet, FederationOptions, ReplayStore, EntityRole, EntityContext, DiscoveryResult, JWKSet, FederationMetadata, FederationEntityMetadataSchema } from '@oidfed/core';
export { EntityId, FederationError, FederationOptions, Result, TrustAnchorSet } from '@oidfed/core';
import { z } from 'zod';

interface ClientAssertionOptions {
    readonly expiresInSeconds?: number;
    /** NumericDate clock used for iat and exp. */
    readonly clock?: Clock;
}
/**
 * Create a client assertion JWT for `private_key_jwt` authentication.
 *
 * This is an OIDC/OAuth2-specific concept used when the RP authenticates
 * to the OP's token endpoint using a signed JWT assertion.
 */
declare function createClientAssertion(clientId: string, audience: string, signer: JwtSigner, options?: ClientAssertionOptions): Promise<string>;

interface ProtocolSigningKeyProvider {
    getRequestObjectSigner(): Promise<JwtSigner>;
    getClientAssertionSigner?(): Promise<JwtSigner>;
}
declare class StaticProtocolSigningKeyProvider implements ProtocolSigningKeyProvider {
    private readonly requestObjectSigner;
    private readonly clientAssertionSigner;
    constructor(options: {
        requestObjectSigner: JwtSigner;
        clientAssertionSigner?: JwtSigner;
    });
    getRequestObjectSigner(): Promise<JwtSigner>;
    getClientAssertionSigner(): Promise<JwtSigner>;
}

/**
 * Optional context passed to adapter methods when the registration request
 * carried a `peer_trust_chain` JWS header. The peer chain provides the OP's
 * metadata/policy as the RP resolved it; the adapter MAY consult these
 * RP-chosen values when validating client metadata or constructing the
 * response.
 */
interface RegistrationProtocolAdapterContext {
    /**
     * The OP's resolved metadata as derived from the validated peer chain
     * (validated by the federation handler before this is passed in). When
     * absent, no peer chain was supplied or it failed validation.
     */
    readonly peerResolvedOpMetadata?: Readonly<Record<string, unknown>>;
}
/**
 * Protocol-specific adapter for the federation registration endpoint.
 *
 * The federation registration handler is protocol-agnostic by default.
 * When an adapter is provided, it is called for protocol-specific metadata
 * validation and enrichment (e.g., OIDC RP metadata validation).
 */
interface RegistrationProtocolAdapter {
    /**
     * Validate protocol-specific client metadata from the registration request.
     * Called after federation-layer validation succeeds.
     *
     * @param raw - The raw metadata object from the registration request
     * @param context - Optional adapter context (peer chain metadata, etc.)
     * @returns The validated metadata or a federation error
     */
    validateClientMetadata(raw: Record<string, unknown>, context?: RegistrationProtocolAdapterContext): Result<Record<string, unknown>, FederationError>;
    /**
     * Enrich the registration response metadata with protocol-specific fields.
     * Called before the response is signed and returned.
     *
     * @param rpMeta - The RP's resolved metadata
     * @param trustChain - The validated trust chain for the RP
     * @param context - Optional adapter context (peer chain metadata, etc.)
     * @returns The enriched metadata for the response
     */
    enrichResponseMetadata(rpMeta: Record<string, unknown>, trustChain: ValidatedTrustChain, context?: RegistrationProtocolAdapterContext): Record<string, unknown>;
}

/**
 * OIDC-specific registration protocol adapter.
 *
 * Validates `openid_relying_party` metadata against the OIDC RP metadata schema
 * and enriches the registration response with `client_id`.
 *
 * Implements the `RegistrationProtocolAdapter` interface from `./adapter-types.js`.
 */
declare class OIDCRegistrationAdapter implements RegistrationProtocolAdapter {
    validateClientMetadata(raw: Record<string, unknown>): Result<Record<string, unknown>, FederationError>;
    enrichResponseMetadata(rpMeta: Record<string, unknown>, trustChain: ValidatedTrustChain): Record<string, unknown>;
}

/** RP-side automatic registration: builds a signed Request Object with embedded trust chain. */

type RequestDelivery = "query" | "form_post" | "request_uri" | "par";
interface AutomaticRegistrationConfig {
    readonly entityId: EntityId;
    readonly protocolKeyProvider: ProtocolSigningKeyProvider;
    readonly authorityHints: readonly [EntityId, ...EntityId[]];
    readonly metadata: Record<string, Record<string, unknown>>;
    /** TTL for the Request Object JWT in seconds (default: 300). */
    readonly requestObjectTtlSeconds?: number;
    /**
     * When true, attach the peer_trust_chain JWS header — a Trust Chain for
     * the OP that ends at the same Trust Anchor as the RP chain. Disabled by
     * default; set to true only when the RP wants the OP to use the
     * metadata/policy values from the RP-built peer chain (for the
     * Federation/Metadata Integrity properties). The library throws if the
     * peer chain to the shared Trust Anchor cannot be built.
     */
    readonly includePeerTrustChain?: boolean;
    /**
     * Selects how the signed Request Object reaches the OP's authorization
     * endpoint. Defaults to `"form_post"` — the safest choice for Request
     * Objects that carry an embedded `trust_chain` (the JWT can easily exceed
     * the practical URL/header length limits of HTTP intermediaries).
     *
     * Pass `"query"` to preserve the historical 0.3.x GET-query behavior.
     */
    readonly requestDelivery?: RequestDelivery;
    /**
     * For `requestDelivery: "request_uri"`: the publicly-reachable URL at
     * which the RP will host the signed Request Object JWT. REQUIRED in that
     * mode and ignored otherwise. The library does NOT host the JWT — the
     * caller must serve the returned `requestObjectJwt` at this URL with
     * Content-Type `application/oauth-authz-req+jwt`, typically with a short
     * TTL and single-use semantics.
     */
    readonly requestUri?: string;
}
interface AutomaticRegistrationResultBase {
    readonly requestObjectJwt: string;
    readonly trustChain: ValidatedTrustChain;
    readonly trustChainExpiresAt: number;
}
/**
 * Discriminated union over `delivery`. Each variant carries exactly the
 * additional fields the caller needs to dispatch the Request Object.
 */
type AutomaticRegistrationResult = (AutomaticRegistrationResultBase & {
    readonly delivery: "query";
    /** Full authorization-endpoint URL with `?request=…&client_id=…`. Redirect the user-agent here. */
    readonly authorizationUrl: string;
}) | (AutomaticRegistrationResultBase & {
    readonly delivery: "form_post";
    /** Bare authorization-endpoint URL. POST `formParams` here. */
    readonly authorizationEndpoint: string;
    /** Form fields to submit as `application/x-www-form-urlencoded` body. */
    readonly formParams: Record<string, string>;
}) | (AutomaticRegistrationResultBase & {
    readonly delivery: "request_uri";
    /** Echoes the caller-supplied URI; cache the `requestObjectJwt` under this URL. */
    readonly requestUri: string;
    /** Full authorization-endpoint URL with `?request_uri=…&client_id=…`. Redirect the user-agent here. */
    readonly authorizationUrl: string;
}) | (AutomaticRegistrationResultBase & {
    readonly delivery: "par";
    /** PAR endpoint URL the library POSTed to. */
    readonly pushedAuthorizationRequestEndpoint: string;
    /** Full authorization-endpoint URL with `?request_uri=urn:…&client_id=…`. Redirect the user-agent here. */
    readonly authorizationUrl: string;
    /** The `urn:`-style request URI returned by the PAR endpoint. */
    readonly parRequestUri: string;
    /** Absolute expiration time (seconds since epoch) computed from the PAR `expires_in` response. */
    readonly parExpiresAt: number;
});

interface ExplicitRegistrationConfig {
    readonly entityId: EntityId;
    readonly keyProvider: FederationKeyProvider;
    readonly authorityHints: readonly [EntityId, ...EntityId[]];
    readonly metadata: Record<string, Record<string, unknown>>;
    readonly entityConfigurationTtlSeconds?: number;
    readonly trustMarks?: ReadonlyArray<Record<string, unknown>>;
    /**
     * When true, attach the peer_trust_chain JWS header — a Trust Chain for
     * the OP that ends at the same Trust Anchor as the RP chain. Disabled by
     * default; set to true only when the RP wants the OP to use the
     * metadata/policy values from the RP-built peer chain (Federation /
     * Metadata Integrity properties). The library throws if the peer chain
     * to the shared Trust Anchor cannot be built. The current emit path
     * always sends an Entity Configuration JWT body (never a Trust-Chain
     * JSON body), so the mutual-exclusion rule between peer_trust_chain
     * and Trust-Chain-JSON request body is structurally satisfied here;
     * do NOT add a Trust-Chain-JSON body shape without also refusing this
     * option in that branch.
     */
    readonly includePeerTrustChain?: boolean;
}
interface ExplicitRegistrationResult {
    readonly registrationStatement: ParsedEntityStatement;
    readonly clientId: string;
    readonly clientSecret?: string;
    readonly expiresAt: number;
    readonly registeredMetadata: Readonly<Record<string, unknown>>;
    /** Trust chain expiration — RP must not use the registration past this time. */
    readonly trustChainExpiresAt: number;
}

/** OP-side explicit registration endpoint handler (self-contained, no authority dep). */

interface ExplicitRegistrationHandlerConfig {
    /** The OP's Entity Identifier — used as the aud check target and as the issuer of the response. */
    readonly opEntityId: EntityId;
    /** Federation-only signing key provider used for the signed registration response. */
    readonly keyProvider: FederationKeyProvider;
    /** Non-empty trust anchors required for RP trust chain resolution. */
    readonly trustAnchors: TrustAnchorSet;
    /** TTL in seconds for the registration response JWT. Capped to chain expiry when a chain is resolved. */
    readonly registrationResponseTtlSeconds?: number;
    /** Optional protocol-specific adapter for metadata validation/enrichment. */
    readonly registrationProtocolAdapter?: RegistrationProtocolAdapter;
    /** Optional generator producing a client_secret embedded in the response. Returning undefined omits the field. */
    readonly generateClientSecret?: (sub: EntityId) => Promise<string | undefined>;
    /** Optional late pre-commit hook fired after response preparation and before `onRegistration`. */
    readonly onRegistrationInvalidation?: (sub: EntityId) => Promise<void>;
    /** Optional callback fired when dynamic registration completes successfully. */
    readonly onRegistration?: (sub: EntityId, clientMetadata: Record<string, unknown>, clientSecret?: string) => Promise<void>;
    /** Federation-wide options (httpClient, clock, etc.). */
    readonly options?: FederationOptions;
}

interface ProcessedRegistration {
    readonly rpEntityId: EntityId;
    readonly resolvedRpMetadata: Readonly<Record<string, unknown>>;
    readonly trustChain: ValidatedTrustChain;
    /**
     * When the Request Object carried a `peer_trust_chain` JWS header, the
     * OP's resolved metadata as derived from the RP-supplied peer chain.
     * Integrators may use these RP-chosen values when creating the client
     * registration; the library validates structural integrity but does not
     * auto-apply the values.
     */
    readonly peerResolvedOpMetadata?: Readonly<Record<string, unknown>>;
}
interface ProcessAutomaticRegistrationOptions extends FederationOptions {
    /** The OP's own Entity Identifier — REQUIRED to prevent cross-OP replay via `aud` validation. */
    opEntityId: EntityId;
    /** Atomic replay protection required for one-time Request Object processing. */
    replayStore: ReplayStore;
}

interface ProcessExplicitRegistrationOptions extends FederationOptions {
    /** The OP's own Entity Identifier — REQUIRED for `aud` validation. */
    opEntityId: EntityId;
    /** Optional `trust_chain` JWS header value supplied with an entity-statement body. */
    trustChainHeader?: readonly string[];
}

/** Typed output of Request Object JWT validation. */
interface ValidatedRequestObject {
    /** The RP's Entity Identifier (from `client_id` / `iss`) */
    readonly rpEntityId: EntityId;
    /** The OP's Entity Identifier (from `aud`) */
    readonly opEntityId: string;
    /** JWT expiration timestamp */
    readonly exp: number;
    /** Unique JWT identifier */
    readonly jti: string;
    /** Issued-at timestamp (if present) */
    readonly iat?: number;
    /** All decoded JWT payload claims */
    readonly claims: Readonly<Record<string, unknown>>;
    /** Trust chain from JWT header (if present) */
    readonly trustChainHeader?: readonly string[];
    /** Peer Trust Chain from JWT header (if present) — Trust Chain for the OP. */
    readonly peerTrustChainHeader?: readonly string[];
}
/** Context for OP-side automatic registration processing */
interface AutomaticRegistrationContext {
    /** The OP's own Entity Identifier */
    readonly opEntityId: EntityId;
    /** Maximum allowed clock skew in seconds (default: 60) */
    readonly clockSkewSeconds?: number;
    /** NumericDate clock used for expiry validation. */
    readonly clock?: Clock;
}
type ValidatedRequestObjectResult = Result<ValidatedRequestObject, FederationError>;

interface OidcRelyingPartyRoleConfig {
    readonly protocolKeyProvider: ProtocolSigningKeyProvider;
    readonly metadata?: Record<string, unknown>;
    readonly requestObjectTtlSeconds?: number;
    readonly includePeerTrustChain?: boolean;
    readonly requestDelivery?: RequestDelivery;
    readonly requestUri?: string;
    readonly trustAnchors?: TrustAnchorSet;
    readonly authorityHints?: readonly EntityId[];
}
interface CreateAuthorizationRequestOptions extends FederationOptions {
    readonly requestDelivery?: RequestDelivery;
    readonly requestUri?: string;
    readonly includePeerTrustChain?: boolean;
    readonly requestObjectTtlSeconds?: number;
    readonly trustAnchors?: TrustAnchorSet;
}
declare class OidcRelyingPartyRole implements EntityRole {
    readonly config: OidcRelyingPartyRoleConfig;
    static createClientAssertion: typeof createClientAssertion;
    readonly type = "openid_relying_party";
    readonly metadata: Record<string, unknown>;
    private context?;
    constructor(config: OidcRelyingPartyRoleConfig);
    initialize(context: EntityContext): void;
    createClientAssertion(audience: string, options?: ClientAssertionOptions): Promise<string>;
    automaticallyRegister(params: {
        readonly opEntityId: string;
        readonly redirect_uri: string;
        readonly scope?: string;
        readonly state?: string;
        readonly nonce?: string;
        readonly requestDelivery?: RequestDelivery;
        readonly requestUri?: string;
    }, options?: CreateAuthorizationRequestOptions): Promise<Result<AutomaticRegistrationResult>>;
    explicitlyRegister(opEntityId: string, options?: FederationOptions & {
        readonly trustAnchors?: TrustAnchorSet;
    }): Promise<Result<ExplicitRegistrationResult>>;
    createAuthorizationRequest(discovery: DiscoveryResult, authzRequestParams: Record<string, string>, trustAnchors: TrustAnchorSet, options?: CreateAuthorizationRequestOptions): Promise<Result<AutomaticRegistrationResult>>;
}
interface OidcProviderRoleConfig {
    readonly registrationPath?: string;
    readonly metadata?: Record<string, unknown>;
    readonly trustAnchors?: TrustAnchorSet;
    readonly registrationResponseTtlSeconds?: number;
    readonly registrationProtocolAdapter?: RegistrationProtocolAdapter;
    readonly generateClientSecret?: (sub: EntityId) => Promise<string | undefined>;
    /** Late pre-commit hook called after validation and response preparation, before `onRegistration`. */
    readonly onRegistrationInvalidation?: (sub: EntityId) => Promise<void>;
    readonly replayStore?: ReplayStore;
    readonly onRegistration?: (sub: EntityId, clientMetadata: Record<string, unknown>, clientSecret?: string) => Promise<void>;
}
declare class OidcProviderRole implements EntityRole {
    readonly config: OidcProviderRoleConfig;
    readonly type = "openid_provider";
    readonly metadata: Record<string, unknown>;
    readonly routes: Map<string, (request: Request) => Promise<Response>>;
    private context?;
    constructor(config: OidcProviderRoleConfig);
    initialize(context: EntityContext): void;
    processAutomaticRegistration(requestObjectJwt: string, options?: Omit<ProcessAutomaticRegistrationOptions, "opEntityId" | "replayStore">): Promise<Result<ProcessedRegistration, FederationError>>;
    processExplicitRegistration(request: Request): Promise<Response>;
}
interface OAuthClientRoleConfig {
    readonly protocolKeyProvider: ProtocolSigningKeyProvider;
    readonly metadata?: Record<string, unknown>;
    readonly requestObjectTtlSeconds?: number;
    readonly includePeerTrustChain?: boolean;
    readonly requestDelivery?: RequestDelivery;
    readonly requestUri?: string;
}
declare class OAuthClientRole implements EntityRole {
    readonly config: OAuthClientRoleConfig;
    static createClientAssertion: typeof createClientAssertion;
    readonly type = "oauth_client";
    readonly metadata: Record<string, unknown>;
    private context?;
    constructor(config: OAuthClientRoleConfig);
    initialize(context: EntityContext): void;
    createAuthorizationRequest(discovery: DiscoveryResult, authzRequestParams: Record<string, string>, trustAnchors: TrustAnchorSet, options?: FederationOptions): Promise<Result<AutomaticRegistrationResult>>;
}
interface OAuthAuthorizationServerRoleConfig {
    readonly registrationPath?: string;
    readonly metadata?: Record<string, unknown>;
    readonly trustAnchors?: TrustAnchorSet;
    readonly registrationResponseTtlSeconds?: number;
    readonly registrationProtocolAdapter?: RegistrationProtocolAdapter;
    readonly generateClientSecret?: (sub: EntityId) => Promise<string | undefined>;
    /** Late pre-commit hook called after validation and response preparation. */
    readonly onRegistrationInvalidation?: (sub: EntityId) => Promise<void>;
}
declare class OAuthAuthorizationServerRole implements EntityRole {
    readonly config: OAuthAuthorizationServerRoleConfig;
    readonly type = "oauth_authorization_server";
    readonly metadata: Record<string, unknown>;
    readonly routes: Map<string, (request: Request) => Promise<Response>>;
    constructor(config: OAuthAuthorizationServerRoleConfig);
    initialize(context: EntityContext): void;
}
interface OAuthResourceRoleConfig {
    readonly metadata?: Record<string, unknown>;
    readonly jwks?: JWKSet;
}
declare class OAuthResourceRole implements EntityRole {
    readonly config: OAuthResourceRoleConfig;
    readonly type = "oauth_resource";
    readonly metadata: Record<string, unknown>;
    readonly routes: Map<string, (request: Request) => Promise<Response>>;
    constructor(config: OAuthResourceRoleConfig);
    initialize(_context: EntityContext): void;
}

/** Explicit registration request payload. */
declare const ExplicitRegistrationRequestPayloadSchema: z.ZodObject<{
    iss: z.core.$ZodBranded<z.ZodURL, "EntityId", "out">;
    sub: z.core.$ZodBranded<z.ZodURL, "EntityId", "out">;
    aud: z.ZodString;
    iat: z.ZodNumber;
    exp: z.ZodNumber;
    jwks: z.ZodObject<{
        keys: z.ZodArray<z.ZodObject<{
            kty: z.ZodEnum<{
                RSA: "RSA";
                EC: "EC";
                OKP: "OKP";
            }>;
            kid: z.ZodOptional<z.ZodString>;
            use: z.ZodOptional<z.ZodEnum<{
                sig: "sig";
                enc: "enc";
            }>>;
            alg: z.ZodOptional<z.ZodString>;
            key_ops: z.ZodOptional<z.ZodArray<z.ZodEnum<{
                sign: "sign";
                verify: "verify";
                encrypt: "encrypt";
                decrypt: "decrypt";
                wrapKey: "wrapKey";
                unwrapKey: "unwrapKey";
                deriveKey: "deriveKey";
                deriveBits: "deriveBits";
            }>>>;
            n: z.ZodOptional<z.ZodString>;
            e: z.ZodOptional<z.ZodString>;
            crv: z.ZodOptional<z.ZodString>;
            x: z.ZodOptional<z.ZodString>;
            y: z.ZodOptional<z.ZodString>;
        }, z.core.$loose>>;
    }, z.core.$strip>;
    authority_hints: z.ZodArray<z.core.$ZodBranded<z.ZodURL, "EntityId", "out">>;
    metadata: z.ZodObject<{
        federation_entity: z.ZodOptional<z.ZodObject<{
            federation_fetch_endpoint: z.ZodOptional<z.ZodURL>;
            federation_list_endpoint: z.ZodOptional<z.ZodURL>;
            federation_extended_list_endpoint: z.ZodOptional<z.ZodURL>;
            federation_resolve_endpoint: z.ZodOptional<z.ZodURL>;
            federation_trust_mark_status_endpoint: z.ZodOptional<z.ZodURL>;
            federation_trust_mark_list_endpoint: z.ZodOptional<z.ZodURL>;
            federation_trust_mark_endpoint: z.ZodOptional<z.ZodURL>;
            federation_historical_keys_endpoint: z.ZodOptional<z.ZodURL>;
            federation_fetch_endpoint_auth_methods: z.ZodOptional<z.ZodArray<z.ZodString>>;
            federation_list_endpoint_auth_methods: z.ZodOptional<z.ZodArray<z.ZodString>>;
            federation_extended_list_endpoint_auth_methods: z.ZodOptional<z.ZodArray<z.ZodString>>;
            federation_resolve_endpoint_auth_methods: z.ZodOptional<z.ZodArray<z.ZodString>>;
            federation_trust_mark_status_endpoint_auth_methods: z.ZodOptional<z.ZodArray<z.ZodString>>;
            federation_trust_mark_list_endpoint_auth_methods: z.ZodOptional<z.ZodArray<z.ZodString>>;
            federation_trust_mark_endpoint_auth_methods: z.ZodOptional<z.ZodArray<z.ZodString>>;
            federation_historical_keys_endpoint_auth_methods: z.ZodOptional<z.ZodArray<z.ZodString>>;
            endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
            organization_name: z.ZodOptional<z.ZodString>;
            display_name: z.ZodOptional<z.ZodString>;
            description: z.ZodOptional<z.ZodString>;
            keywords: z.ZodOptional<z.ZodArray<z.ZodString>>;
            contacts: z.ZodOptional<z.ZodArray<z.ZodString>>;
            logo_uri: z.ZodOptional<z.ZodString>;
            policy_uri: z.ZodOptional<z.ZodString>;
            information_uri: z.ZodOptional<z.ZodString>;
            organization_uri: z.ZodOptional<z.ZodString>;
        }, z.core.$loose>>;
        openid_relying_party: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
        openid_provider: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
        oauth_authorization_server: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
        oauth_client: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
        oauth_resource: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
    }, z.core.$loose>;
    trust_marks: z.ZodOptional<z.ZodArray<z.ZodObject<{
        trust_mark_type: z.ZodString;
        trust_mark: z.ZodString;
    }, z.core.$strip>>>;
}, z.core.$loose>;
/** Explicit registration response payload. */
declare const ExplicitRegistrationResponsePayloadSchema: z.ZodObject<{
    iss: z.core.$ZodBranded<z.ZodURL, "EntityId", "out">;
    sub: z.core.$ZodBranded<z.ZodURL, "EntityId", "out">;
    aud: z.ZodString;
    iat: z.ZodNumber;
    exp: z.ZodNumber;
    metadata: z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>;
    trust_anchor: z.core.$ZodBranded<z.ZodURL, "EntityId", "out">;
    authority_hints: z.ZodArray<z.core.$ZodBranded<z.ZodURL, "EntityId", "out">>;
}, z.core.$loose>;
type ExplicitRegistrationRequestPayload = z.infer<typeof ExplicitRegistrationRequestPayloadSchema>;
type ExplicitRegistrationResponsePayload = z.infer<typeof ExplicitRegistrationResponsePayloadSchema>;

/**
 * Typed Zod schemas for all OpenID Federation 1.0 entity type metadata.
 *
 * Covers:
 *   - openid_relying_party  (OIDC Dynamic Registration 1.0 + Federation 1.0)
 *   - openid_provider       (OIDC Discovery 1.0 + Federation 1.0)
 *   - oauth_authorization_server (RFC 8414 + Federation 1.0)
 *   - oauth_client           (RFC 7591 + Federation 1.0)
 *   - oauth_resource          (RFC 9728 + Federation 1.0)
 */

declare const OPENID_RP_REGISTRATION_RESPONSE_FIELDS: readonly ["client_id", "client_secret", "client_id_issued_at", "client_secret_expires_at"];
declare const OpenIDRelyingPartyMetadataSchema: z.ZodObject<{
    jwks_uri: z.ZodOptional<z.ZodURL>;
    jwks: z.ZodOptional<z.ZodObject<{
        keys: z.ZodArray<z.ZodObject<{
            kty: z.ZodEnum<{
                RSA: "RSA";
                EC: "EC";
                OKP: "OKP";
            }>;
            kid: z.ZodOptional<z.ZodString>;
            use: z.ZodOptional<z.ZodEnum<{
                sig: "sig";
                enc: "enc";
            }>>;
            alg: z.ZodOptional<z.ZodString>;
            key_ops: z.ZodOptional<z.ZodArray<z.ZodEnum<{
                sign: "sign";
                verify: "verify";
                encrypt: "encrypt";
                decrypt: "decrypt";
                wrapKey: "wrapKey";
                unwrapKey: "unwrapKey";
                deriveKey: "deriveKey";
                deriveBits: "deriveBits";
            }>>>;
            n: z.ZodOptional<z.ZodString>;
            e: z.ZodOptional<z.ZodString>;
            crv: z.ZodOptional<z.ZodString>;
            x: z.ZodOptional<z.ZodString>;
            y: z.ZodOptional<z.ZodString>;
        }, z.core.$loose>>;
    }, z.core.$strip>>;
    sector_identifier_uri: z.ZodOptional<z.ZodString>;
    subject_type: z.ZodOptional<z.ZodEnum<{
        public: "public";
        pairwise: "pairwise";
    }>>;
    id_token_signed_response_alg: z.ZodOptional<z.ZodString>;
    id_token_encrypted_response_alg: z.ZodOptional<z.ZodString>;
    id_token_encrypted_response_enc: z.ZodOptional<z.ZodString>;
    userinfo_signed_response_alg: z.ZodOptional<z.ZodString>;
    userinfo_encrypted_response_alg: z.ZodOptional<z.ZodString>;
    userinfo_encrypted_response_enc: z.ZodOptional<z.ZodString>;
    request_object_signing_alg: z.ZodOptional<z.ZodString>;
    request_object_encryption_alg: z.ZodOptional<z.ZodString>;
    request_object_encryption_enc: z.ZodOptional<z.ZodString>;
    token_endpoint_auth_method: z.ZodOptional<z.ZodString>;
    token_endpoint_auth_signing_alg: z.ZodOptional<z.ZodString>;
    default_max_age: z.ZodOptional<z.ZodNumber>;
    require_auth_time: z.ZodOptional<z.ZodBoolean>;
    default_acr_values: z.ZodOptional<z.ZodArray<z.ZodString>>;
    initiate_login_uri: z.ZodOptional<z.ZodString>;
    post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodString>>;
    backchannel_token_delivery_mode: z.ZodOptional<z.ZodString>;
    backchannel_client_notification_endpoint: z.ZodOptional<z.ZodString>;
    backchannel_authentication_request_signing_alg: z.ZodOptional<z.ZodString>;
    backchannel_user_code_parameter: z.ZodOptional<z.ZodBoolean>;
    client_registration_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
    signed_jwks_uri: z.ZodOptional<z.ZodURL>;
    organization_identifier: z.ZodOptional<z.ZodString>;
    scope: z.ZodOptional<z.ZodString>;
    organization_name: z.ZodOptional<z.ZodString>;
    display_name: z.ZodOptional<z.ZodString>;
    description: z.ZodOptional<z.ZodString>;
    keywords: z.ZodOptional<z.ZodArray<z.ZodString>>;
    contacts: z.ZodOptional<z.ZodArray<z.ZodString>>;
    logo_uri: z.ZodOptional<z.ZodString>;
    policy_uri: z.ZodOptional<z.ZodString>;
    information_uri: z.ZodOptional<z.ZodString>;
    organization_uri: z.ZodOptional<z.ZodString>;
    redirect_uris: z.ZodOptional<z.ZodArray<z.ZodString>>;
    response_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
    grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
    application_type: z.ZodOptional<z.ZodEnum<{
        web: "web";
        native: "native";
    }>>;
    client_name: z.ZodOptional<z.ZodString>;
    client_uri: z.ZodOptional<z.ZodString>;
    tos_uri: z.ZodOptional<z.ZodString>;
}, z.core.$loose>;
/**
 * Typed OpenID Relying Party metadata as carried in an Explicit Registration Response.
 * Includes registration-response credential fields that are not valid in Entity
 * Configuration or Subordinate Statement metadata.
 */
declare const OpenIDRelyingPartyRegistrationResponseMetadataSchema: z.ZodObject<{
    client_id: z.ZodString;
    client_secret: z.ZodOptional<z.ZodString>;
    client_id_issued_at: z.ZodOptional<z.ZodNumber>;
    client_secret_expires_at: z.ZodOptional<z.ZodNumber>;
    jwks_uri: z.ZodOptional<z.ZodURL>;
    jwks: z.ZodOptional<z.ZodObject<{
        keys: z.ZodArray<z.ZodObject<{
            kty: z.ZodEnum<{
                RSA: "RSA";
                EC: "EC";
                OKP: "OKP";
            }>;
            kid: z.ZodOptional<z.ZodString>;
            use: z.ZodOptional<z.ZodEnum<{
                sig: "sig";
                enc: "enc";
            }>>;
            alg: z.ZodOptional<z.ZodString>;
            key_ops: z.ZodOptional<z.ZodArray<z.ZodEnum<{
                sign: "sign";
                verify: "verify";
                encrypt: "encrypt";
                decrypt: "decrypt";
                wrapKey: "wrapKey";
                unwrapKey: "unwrapKey";
                deriveKey: "deriveKey";
                deriveBits: "deriveBits";
            }>>>;
            n: z.ZodOptional<z.ZodString>;
            e: z.ZodOptional<z.ZodString>;
            crv: z.ZodOptional<z.ZodString>;
            x: z.ZodOptional<z.ZodString>;
            y: z.ZodOptional<z.ZodString>;
        }, z.core.$loose>>;
    }, z.core.$strip>>;
    sector_identifier_uri: z.ZodOptional<z.ZodString>;
    subject_type: z.ZodOptional<z.ZodEnum<{
        public: "public";
        pairwise: "pairwise";
    }>>;
    id_token_signed_response_alg: z.ZodOptional<z.ZodString>;
    id_token_encrypted_response_alg: z.ZodOptional<z.ZodString>;
    id_token_encrypted_response_enc: z.ZodOptional<z.ZodString>;
    userinfo_signed_response_alg: z.ZodOptional<z.ZodString>;
    userinfo_encrypted_response_alg: z.ZodOptional<z.ZodString>;
    userinfo_encrypted_response_enc: z.ZodOptional<z.ZodString>;
    request_object_signing_alg: z.ZodOptional<z.ZodString>;
    request_object_encryption_alg: z.ZodOptional<z.ZodString>;
    request_object_encryption_enc: z.ZodOptional<z.ZodString>;
    token_endpoint_auth_method: z.ZodOptional<z.ZodString>;
    token_endpoint_auth_signing_alg: z.ZodOptional<z.ZodString>;
    default_max_age: z.ZodOptional<z.ZodNumber>;
    require_auth_time: z.ZodOptional<z.ZodBoolean>;
    default_acr_values: z.ZodOptional<z.ZodArray<z.ZodString>>;
    initiate_login_uri: z.ZodOptional<z.ZodString>;
    post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodString>>;
    backchannel_token_delivery_mode: z.ZodOptional<z.ZodString>;
    backchannel_client_notification_endpoint: z.ZodOptional<z.ZodString>;
    backchannel_authentication_request_signing_alg: z.ZodOptional<z.ZodString>;
    backchannel_user_code_parameter: z.ZodOptional<z.ZodBoolean>;
    client_registration_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
    signed_jwks_uri: z.ZodOptional<z.ZodURL>;
    organization_identifier: z.ZodOptional<z.ZodString>;
    scope: z.ZodOptional<z.ZodString>;
    organization_name: z.ZodOptional<z.ZodString>;
    display_name: z.ZodOptional<z.ZodString>;
    description: z.ZodOptional<z.ZodString>;
    keywords: z.ZodOptional<z.ZodArray<z.ZodString>>;
    contacts: z.ZodOptional<z.ZodArray<z.ZodString>>;
    logo_uri: z.ZodOptional<z.ZodString>;
    policy_uri: z.ZodOptional<z.ZodString>;
    information_uri: z.ZodOptional<z.ZodString>;
    organization_uri: z.ZodOptional<z.ZodString>;
    redirect_uris: z.ZodOptional<z.ZodArray<z.ZodString>>;
    response_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
    grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
    application_type: z.ZodOptional<z.ZodEnum<{
        web: "web";
        native: "native";
    }>>;
    client_name: z.ZodOptional<z.ZodString>;
    client_uri: z.ZodOptional<z.ZodString>;
    tos_uri: z.ZodOptional<z.ZodString>;
}, z.core.$loose>;
/**
 * Typed OpenID Provider metadata schema.
 * Validates parameters from OIDC Discovery 1.0 (Section 3),
 * IANA OAuth AS Metadata registry entries, session management / logout,
 * CIBA, and OpenID Federation 1.0 Section 5.1 federation-specific parameters.
 */
declare const OpenIDProviderMetadataSchema: z.ZodObject<{
    client_registration_types_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    federation_registration_endpoint: z.ZodOptional<z.ZodURL>;
    signed_jwks_uri: z.ZodOptional<z.ZodURL>;
    organization_identifier: z.ZodOptional<z.ZodString>;
    organization_name: z.ZodOptional<z.ZodString>;
    display_name: z.ZodOptional<z.ZodString>;
    description: z.ZodOptional<z.ZodString>;
    keywords: z.ZodOptional<z.ZodArray<z.ZodString>>;
    contacts: z.ZodOptional<z.ZodArray<z.ZodString>>;
    logo_uri: z.ZodOptional<z.ZodString>;
    policy_uri: z.ZodOptional<z.ZodString>;
    information_uri: z.ZodOptional<z.ZodString>;
    organization_uri: z.ZodOptional<z.ZodString>;
    issuer: z.ZodString;
    authorization_endpoint: z.ZodString;
    token_endpoint: z.ZodOptional<z.ZodString>;
    userinfo_endpoint: z.ZodOptional<z.ZodString>;
    jwks_uri: z.ZodOptional<z.ZodURL>;
    jwks: z.ZodOptional<z.ZodObject<{
        keys: z.ZodArray<z.ZodObject<{
            kty: z.ZodEnum<{
                RSA: "RSA";
                EC: "EC";
                OKP: "OKP";
            }>;
            kid: z.ZodOptional<z.ZodString>;
            use: z.ZodOptional<z.ZodEnum<{
                sig: "sig";
                enc: "enc";
            }>>;
            alg: z.ZodOptional<z.ZodString>;
            key_ops: z.ZodOptional<z.ZodArray<z.ZodEnum<{
                sign: "sign";
                verify: "verify";
                encrypt: "encrypt";
                decrypt: "decrypt";
                wrapKey: "wrapKey";
                unwrapKey: "unwrapKey";
                deriveKey: "deriveKey";
                deriveBits: "deriveBits";
            }>>>;
            n: z.ZodOptional<z.ZodString>;
            e: z.ZodOptional<z.ZodString>;
            crv: z.ZodOptional<z.ZodString>;
            x: z.ZodOptional<z.ZodString>;
            y: z.ZodOptional<z.ZodString>;
        }, z.core.$loose>>;
    }, z.core.$strip>>;
    registration_endpoint: z.ZodOptional<z.ZodURL>;
    scopes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    response_types_supported: z.ZodArray<z.ZodString>;
    response_modes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    grant_types_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    acr_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    subject_types_supported: z.ZodArray<z.ZodString>;
    id_token_signing_alg_values_supported: z.ZodArray<z.ZodString>;
    id_token_encryption_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    id_token_encryption_enc_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    userinfo_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    userinfo_encryption_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    userinfo_encryption_enc_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    request_object_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    request_object_encryption_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    request_object_encryption_enc_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    token_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    token_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    display_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    claim_types_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    claims_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    service_documentation: z.ZodOptional<z.ZodString>;
    claims_locales_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    ui_locales_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    claims_parameter_supported: z.ZodOptional<z.ZodBoolean>;
    request_parameter_supported: z.ZodOptional<z.ZodBoolean>;
    request_uri_parameter_supported: z.ZodOptional<z.ZodBoolean>;
    require_request_uri_registration: z.ZodOptional<z.ZodBoolean>;
    op_policy_uri: z.ZodOptional<z.ZodString>;
    op_tos_uri: z.ZodOptional<z.ZodString>;
    end_session_endpoint: z.ZodOptional<z.ZodString>;
    frontchannel_logout_supported: z.ZodOptional<z.ZodBoolean>;
    frontchannel_logout_session_supported: z.ZodOptional<z.ZodBoolean>;
    backchannel_logout_supported: z.ZodOptional<z.ZodBoolean>;
    backchannel_logout_session_supported: z.ZodOptional<z.ZodBoolean>;
    backchannel_token_delivery_modes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    backchannel_authentication_endpoint: z.ZodOptional<z.ZodString>;
    backchannel_user_code_parameter_supported: z.ZodOptional<z.ZodBoolean>;
}, z.core.$loose>;
type OpenIDRelyingPartyResponseOnlyFields = {
    readonly [K in (typeof OPENID_RP_REGISTRATION_RESPONSE_FIELDS)[number]]?: never;
};
type OpenIDRelyingPartyMetadata = z.infer<typeof OpenIDRelyingPartyMetadataSchema> & OpenIDRelyingPartyResponseOnlyFields;
type OpenIDRelyingPartyRegistrationResponseMetadata = z.infer<typeof OpenIDRelyingPartyRegistrationResponseMetadataSchema>;
type OpenIDProviderMetadata = z.infer<typeof OpenIDProviderMetadataSchema>;
/**
 * Typed OAuth 2.0 Authorization Server metadata schema.
 * Validates parameters from RFC 8414 (Section 2), extension RFCs
 * (RFC 7636 PKCE, RFC 8628 Device Auth, RFC 9126 PAR, RFC 9207 Issuer ID,
 * RFC 9449 DPoP), and OpenID Federation 1.0 Section 5.1.3 extensions.
 */
declare const OAuthAuthorizationServerMetadataSchema: z.ZodObject<{
    client_registration_types_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    federation_registration_endpoint: z.ZodOptional<z.ZodURL>;
    signed_jwks_uri: z.ZodOptional<z.ZodURL>;
    organization_identifier: z.ZodOptional<z.ZodString>;
    organization_name: z.ZodOptional<z.ZodString>;
    display_name: z.ZodOptional<z.ZodString>;
    description: z.ZodOptional<z.ZodString>;
    keywords: z.ZodOptional<z.ZodArray<z.ZodString>>;
    contacts: z.ZodOptional<z.ZodArray<z.ZodString>>;
    logo_uri: z.ZodOptional<z.ZodString>;
    policy_uri: z.ZodOptional<z.ZodString>;
    information_uri: z.ZodOptional<z.ZodString>;
    organization_uri: z.ZodOptional<z.ZodString>;
    issuer: z.ZodString;
    authorization_endpoint: z.ZodOptional<z.ZodString>;
    token_endpoint: z.ZodOptional<z.ZodString>;
    jwks_uri: z.ZodOptional<z.ZodURL>;
    jwks: z.ZodOptional<z.ZodObject<{
        keys: z.ZodArray<z.ZodObject<{
            kty: z.ZodEnum<{
                RSA: "RSA";
                EC: "EC";
                OKP: "OKP";
            }>;
            kid: z.ZodOptional<z.ZodString>;
            use: z.ZodOptional<z.ZodEnum<{
                sig: "sig";
                enc: "enc";
            }>>;
            alg: z.ZodOptional<z.ZodString>;
            key_ops: z.ZodOptional<z.ZodArray<z.ZodEnum<{
                sign: "sign";
                verify: "verify";
                encrypt: "encrypt";
                decrypt: "decrypt";
                wrapKey: "wrapKey";
                unwrapKey: "unwrapKey";
                deriveKey: "deriveKey";
                deriveBits: "deriveBits";
            }>>>;
            n: z.ZodOptional<z.ZodString>;
            e: z.ZodOptional<z.ZodString>;
            crv: z.ZodOptional<z.ZodString>;
            x: z.ZodOptional<z.ZodString>;
            y: z.ZodOptional<z.ZodString>;
        }, z.core.$loose>>;
    }, z.core.$strip>>;
    registration_endpoint: z.ZodOptional<z.ZodURL>;
    scopes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    response_types_supported: z.ZodArray<z.ZodString>;
    response_modes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    grant_types_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    token_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    token_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    service_documentation: z.ZodOptional<z.ZodString>;
    ui_locales_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    op_policy_uri: z.ZodOptional<z.ZodString>;
    op_tos_uri: z.ZodOptional<z.ZodString>;
    revocation_endpoint: z.ZodOptional<z.ZodString>;
    revocation_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    revocation_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    introspection_endpoint: z.ZodOptional<z.ZodString>;
    introspection_endpoint_auth_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    introspection_endpoint_auth_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    code_challenge_methods_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    device_authorization_endpoint: z.ZodOptional<z.ZodString>;
    pushed_authorization_request_endpoint: z.ZodOptional<z.ZodString>;
    require_pushed_authorization_requests: z.ZodOptional<z.ZodBoolean>;
    dpop_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    authorization_response_iss_parameter_supported: z.ZodOptional<z.ZodBoolean>;
}, z.core.$loose>;
type OAuthAuthorizationServerMetadata = z.infer<typeof OAuthAuthorizationServerMetadataSchema>;
/**
 * Typed OAuth 2.0 Client metadata schema.
 * Validates parameters from RFC 7591 (OAuth 2.0 Dynamic Client Registration)
 * and OpenID Federation 1.0 Section 5.1.4 extensions.
 */
declare const OAuthClientMetadataSchema: z.ZodObject<{
    jwks_uri: z.ZodOptional<z.ZodURL>;
    jwks: z.ZodOptional<z.ZodObject<{
        keys: z.ZodArray<z.ZodObject<{
            kty: z.ZodEnum<{
                RSA: "RSA";
                EC: "EC";
                OKP: "OKP";
            }>;
            kid: z.ZodOptional<z.ZodString>;
            use: z.ZodOptional<z.ZodEnum<{
                sig: "sig";
                enc: "enc";
            }>>;
            alg: z.ZodOptional<z.ZodString>;
            key_ops: z.ZodOptional<z.ZodArray<z.ZodEnum<{
                sign: "sign";
                verify: "verify";
                encrypt: "encrypt";
                decrypt: "decrypt";
                wrapKey: "wrapKey";
                unwrapKey: "unwrapKey";
                deriveKey: "deriveKey";
                deriveBits: "deriveBits";
            }>>>;
            n: z.ZodOptional<z.ZodString>;
            e: z.ZodOptional<z.ZodString>;
            crv: z.ZodOptional<z.ZodString>;
            x: z.ZodOptional<z.ZodString>;
            y: z.ZodOptional<z.ZodString>;
        }, z.core.$loose>>;
    }, z.core.$strip>>;
    software_id: z.ZodOptional<z.ZodString>;
    software_version: z.ZodOptional<z.ZodString>;
    client_registration_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
    signed_jwks_uri: z.ZodOptional<z.ZodURL>;
    organization_identifier: z.ZodOptional<z.ZodString>;
    organization_name: z.ZodOptional<z.ZodString>;
    display_name: z.ZodOptional<z.ZodString>;
    description: z.ZodOptional<z.ZodString>;
    keywords: z.ZodOptional<z.ZodArray<z.ZodString>>;
    contacts: z.ZodOptional<z.ZodArray<z.ZodString>>;
    logo_uri: z.ZodOptional<z.ZodString>;
    policy_uri: z.ZodOptional<z.ZodString>;
    information_uri: z.ZodOptional<z.ZodString>;
    organization_uri: z.ZodOptional<z.ZodString>;
    redirect_uris: z.ZodOptional<z.ZodArray<z.ZodString>>;
    token_endpoint_auth_method: z.ZodOptional<z.ZodString>;
    token_endpoint_auth_signing_alg: z.ZodOptional<z.ZodString>;
    grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
    response_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
    client_name: z.ZodOptional<z.ZodString>;
    client_uri: z.ZodOptional<z.ZodString>;
    scope: z.ZodOptional<z.ZodString>;
    tos_uri: z.ZodOptional<z.ZodString>;
}, z.core.$loose>;
type OAuthClientMetadata = z.infer<typeof OAuthClientMetadataSchema>;
/**
 * Typed OAuth 2.0 Protected Resource metadata schema.
 * Validates parameters from RFC 9728 (OAuth 2.0 Protected Resource Metadata)
 * and OpenID Federation 1.0 Section 5.1.5 extensions.
 */
declare const OAuthResourceMetadataSchema: z.ZodObject<{
    signed_jwks_uri: z.ZodOptional<z.ZodURL>;
    organization_identifier: z.ZodOptional<z.ZodString>;
    organization_name: z.ZodOptional<z.ZodString>;
    display_name: z.ZodOptional<z.ZodString>;
    description: z.ZodOptional<z.ZodString>;
    keywords: z.ZodOptional<z.ZodArray<z.ZodString>>;
    contacts: z.ZodOptional<z.ZodArray<z.ZodString>>;
    logo_uri: z.ZodOptional<z.ZodString>;
    policy_uri: z.ZodOptional<z.ZodString>;
    information_uri: z.ZodOptional<z.ZodString>;
    organization_uri: z.ZodOptional<z.ZodString>;
    resource: z.ZodString;
    authorization_servers: z.ZodOptional<z.ZodArray<z.ZodString>>;
    bearer_methods_supported: z.ZodOptional<z.ZodArray<z.ZodEnum<{
        header: "header";
        body: "body";
        query: "query";
    }>>>;
    resource_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    dpop_signing_alg_values_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    scopes_supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
    jwks_uri: z.ZodOptional<z.ZodURL>;
    jwks: z.ZodOptional<z.ZodObject<{
        keys: z.ZodArray<z.ZodObject<{
            kty: z.ZodEnum<{
                RSA: "RSA";
                EC: "EC";
                OKP: "OKP";
            }>;
            kid: z.ZodOptional<z.ZodString>;
            use: z.ZodOptional<z.ZodEnum<{
                sig: "sig";
                enc: "enc";
            }>>;
            alg: z.ZodOptional<z.ZodString>;
            key_ops: z.ZodOptional<z.ZodArray<z.ZodEnum<{
                sign: "sign";
                verify: "verify";
                encrypt: "encrypt";
                decrypt: "decrypt";
                wrapKey: "wrapKey";
                unwrapKey: "unwrapKey";
                deriveKey: "deriveKey";
                deriveBits: "deriveBits";
            }>>>;
            n: z.ZodOptional<z.ZodString>;
            e: z.ZodOptional<z.ZodString>;
            crv: z.ZodOptional<z.ZodString>;
            x: z.ZodOptional<z.ZodString>;
            y: z.ZodOptional<z.ZodString>;
        }, z.core.$loose>>;
    }, z.core.$strip>>;
}, z.core.$loose>;
type OAuthResourceMetadata = z.infer<typeof OAuthResourceMetadataSchema>;
type OIDCFederationMetadata = FederationMetadata & {
    readonly federation_entity?: z.infer<typeof FederationEntityMetadataSchema>;
    readonly openid_relying_party?: OpenIDRelyingPartyMetadata;
    readonly openid_provider?: OpenIDProviderMetadata;
    readonly oauth_authorization_server?: OAuthAuthorizationServerMetadata;
    readonly oauth_client?: OAuthClientMetadata;
    readonly oauth_resource?: OAuthResourceMetadata;
};

export { type AutomaticRegistrationConfig, type AutomaticRegistrationContext, type AutomaticRegistrationResult, type ClientAssertionOptions, type CreateAuthorizationRequestOptions, type ExplicitRegistrationConfig, type ExplicitRegistrationHandlerConfig, type ExplicitRegistrationRequestPayload, type ExplicitRegistrationResponsePayload, type ExplicitRegistrationResult, type OAuthAuthorizationServerMetadata, OAuthAuthorizationServerRole, type OAuthAuthorizationServerRoleConfig, type OAuthClientMetadata, OAuthClientRole, type OAuthClientRoleConfig, type OAuthResourceMetadata, OAuthResourceRole, type OAuthResourceRoleConfig, type OIDCFederationMetadata, OIDCRegistrationAdapter, OidcProviderRole, type OidcProviderRoleConfig, OidcRelyingPartyRole, type OidcRelyingPartyRoleConfig, type OpenIDProviderMetadata, type OpenIDRelyingPartyMetadata, type OpenIDRelyingPartyRegistrationResponseMetadata, type ProcessAutomaticRegistrationOptions, type ProcessExplicitRegistrationOptions, type ProcessedRegistration, type ProtocolSigningKeyProvider, type RegistrationProtocolAdapter, type RegistrationProtocolAdapterContext, type RequestDelivery, StaticProtocolSigningKeyProvider, type ValidatedRequestObject, type ValidatedRequestObjectResult };