/**
 * OAuth Client ID Metadata Document (CIMD,
 * draft-ietf-oauth-client-id-metadata-document) describing this server as an
 * OAuth client to ULS.
 *
 * This is the complete allow-list of published fields — anything not declared
 * here never ships. The document is public by design and must contain no
 * secrets: `token_endpoint_auth_method` is "none" because the server
 * authenticates exchanges with the user's subject_token, not a client
 * credential.
 *
 * `redirect_uris` is deliberately absent: this server is never an
 * authorization-code client (its only grant is token exchange), and ULS
 * dereferences CIMD documents only during redirect-URI validation. Omitting
 * the field makes any authorize attempt under this client_id fail loudly
 * instead of validating against a URI list we would never use. For the
 * token-exchange path the document is currently inert at ULS — the client_id
 * is honored via a ULS client registry entry keyed by this same URL — but it
 * is the identity CIMD requires: `client_id` equals the URL the document is
 * fetched from.
 */
export interface ClientMetadataDocument {
    client_id: string;
    client_name: string;
    grant_types: string[];
    token_endpoint_auth_method: "none";
}
/**
 * URL the client metadata document is served at. CIMD requires the document's
 * `client_id` to equal the exact URL it is fetched from, so this URL is also
 * the server's client_id in ULS token exchanges.
 */
export declare function buildClientMetadataUrl(baseUrl: string, baseUrlPath: string): string;
export declare function buildClientMetadataDocument(clientId: string): ClientMetadataDocument;
//# sourceMappingURL=clientMetadata.d.ts.map