import { GlitchMcpConfig } from "./config.js";
/**
 * Optional OAuth 2.0 Protected Resource Metadata (RFC 9728).
 *
 * OAuth is opt-in (GLITCH_MCP_OAUTH_ENABLED). When enabled, the HTTP server
 * advertises this metadata so MCP clients can discover the authorization server,
 * and challenges unauthenticated requests with a WWW-Authenticate header. Actual
 * token verification stays with the hosted Glitch service — this adapter only
 * forwards the bearer. When OAuth is disabled, plain bearer-token auth still works.
 */
export declare const PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource";
export interface ProtectedResourceMetadata {
    readonly resource: string;
    readonly authorization_servers: string[];
    readonly bearer_methods_supported: string[];
    readonly scopes_supported?: string[];
    readonly resource_documentation: string;
}
export declare function protectedResourceMetadata(config: GlitchMcpConfig, fallbackResourceUrl: string): ProtectedResourceMetadata;
/** WWW-Authenticate value pointing clients at the protected-resource metadata. */
export declare function wwwAuthenticateHeader(metadataUrl: string): string;