/**
 * JWT Access Token Types for MCP OAuth
 *
 * This module defines token claim schemas and validation
 * for JWT access tokens following RFC 9068 and MCP 2025-11-25 requirements.
 */
import { z } from 'zod';
/**
 * JWT Access Token Claims (RFC 9068)
 * Enhanced with MCP 2025-11-25 requirements
 *
 * @see https://www.rfc-editor.org/rfc/rfc9068
 */
export declare const JWTAccessTokenClaimsSchema: z.ZodObject<{
    /**
     * Issuer - MUST be the authorization server issuer URL
     */
    iss: z.ZodString;
    /**
     * Subject - identifier for the principal (user)
     */
    sub: z.ZodString;
    /**
     * Audience - REQUIRED for MCP 2025-11-25
     * Can be a single string or array of strings
     * MUST include the resource server (MCP server URL)
     */
    aud: z.ZodEffects<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>, string | string[], string | string[]>;
    /**
     * Expiration time - Unix timestamp
     */
    exp: z.ZodNumber;
    /**
     * Issued at - Unix timestamp
     */
    iat: z.ZodNumber;
    /**
     * Not before - Unix timestamp (optional)
     */
    nbf: z.ZodOptional<z.ZodNumber>;
    /**
     * JWT ID - unique identifier (optional)
     */
    jti: z.ZodOptional<z.ZodString>;
    /**
     * Client ID - the OAuth client identifier
     */
    client_id: z.ZodString;
    /**
     * Scope - space-separated list of scopes
     */
    scope: z.ZodOptional<z.ZodString>;
    /**
     * Resource - the protected resource (MCP server URL)
     * REQUIRED in MCP 2025-11-25
     *
     * @see https://www.rfc-editor.org/rfc/rfc8707
     */
    resource: z.ZodOptional<z.ZodString>;
}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
    /**
     * Issuer - MUST be the authorization server issuer URL
     */
    iss: z.ZodString;
    /**
     * Subject - identifier for the principal (user)
     */
    sub: z.ZodString;
    /**
     * Audience - REQUIRED for MCP 2025-11-25
     * Can be a single string or array of strings
     * MUST include the resource server (MCP server URL)
     */
    aud: z.ZodEffects<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>, string | string[], string | string[]>;
    /**
     * Expiration time - Unix timestamp
     */
    exp: z.ZodNumber;
    /**
     * Issued at - Unix timestamp
     */
    iat: z.ZodNumber;
    /**
     * Not before - Unix timestamp (optional)
     */
    nbf: z.ZodOptional<z.ZodNumber>;
    /**
     * JWT ID - unique identifier (optional)
     */
    jti: z.ZodOptional<z.ZodString>;
    /**
     * Client ID - the OAuth client identifier
     */
    client_id: z.ZodString;
    /**
     * Scope - space-separated list of scopes
     */
    scope: z.ZodOptional<z.ZodString>;
    /**
     * Resource - the protected resource (MCP server URL)
     * REQUIRED in MCP 2025-11-25
     *
     * @see https://www.rfc-editor.org/rfc/rfc8707
     */
    resource: z.ZodOptional<z.ZodString>;
}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
    /**
     * Issuer - MUST be the authorization server issuer URL
     */
    iss: z.ZodString;
    /**
     * Subject - identifier for the principal (user)
     */
    sub: z.ZodString;
    /**
     * Audience - REQUIRED for MCP 2025-11-25
     * Can be a single string or array of strings
     * MUST include the resource server (MCP server URL)
     */
    aud: z.ZodEffects<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>, string | string[], string | string[]>;
    /**
     * Expiration time - Unix timestamp
     */
    exp: z.ZodNumber;
    /**
     * Issued at - Unix timestamp
     */
    iat: z.ZodNumber;
    /**
     * Not before - Unix timestamp (optional)
     */
    nbf: z.ZodOptional<z.ZodNumber>;
    /**
     * JWT ID - unique identifier (optional)
     */
    jti: z.ZodOptional<z.ZodString>;
    /**
     * Client ID - the OAuth client identifier
     */
    client_id: z.ZodString;
    /**
     * Scope - space-separated list of scopes
     */
    scope: z.ZodOptional<z.ZodString>;
    /**
     * Resource - the protected resource (MCP server URL)
     * REQUIRED in MCP 2025-11-25
     *
     * @see https://www.rfc-editor.org/rfc/rfc8707
     */
    resource: z.ZodOptional<z.ZodString>;
}, z.ZodTypeAny, "passthrough">>;
/**
 * Inferred TypeScript type from the schema
 */
export type JWTAccessTokenClaims = z.infer<typeof JWTAccessTokenClaimsSchema>;
/**
 * OAuth 2.0 Token Response (RFC 6749)
 */
export declare const TokenResponseSchema: z.ZodObject<{
    /**
     * The access token issued by the authorization server
     */
    access_token: z.ZodString;
    /**
     * The type of token (typically "Bearer")
     */
    token_type: z.ZodDefault<z.ZodString>;
    /**
     * Token lifetime in seconds (optional)
     */
    expires_in: z.ZodOptional<z.ZodNumber>;
    /**
     * Refresh token (optional)
     */
    refresh_token: z.ZodOptional<z.ZodString>;
    /**
     * Scope of the access token (optional)
     * If omitted, same as requested scope
     */
    scope: z.ZodOptional<z.ZodString>;
    /**
     * Resource indicators (RFC 8707) - optional
     * List of resources this token is valid for
     */
    resource: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>>;
}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
    /**
     * The access token issued by the authorization server
     */
    access_token: z.ZodString;
    /**
     * The type of token (typically "Bearer")
     */
    token_type: z.ZodDefault<z.ZodString>;
    /**
     * Token lifetime in seconds (optional)
     */
    expires_in: z.ZodOptional<z.ZodNumber>;
    /**
     * Refresh token (optional)
     */
    refresh_token: z.ZodOptional<z.ZodString>;
    /**
     * Scope of the access token (optional)
     * If omitted, same as requested scope
     */
    scope: z.ZodOptional<z.ZodString>;
    /**
     * Resource indicators (RFC 8707) - optional
     * List of resources this token is valid for
     */
    resource: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>>;
}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
    /**
     * The access token issued by the authorization server
     */
    access_token: z.ZodString;
    /**
     * The type of token (typically "Bearer")
     */
    token_type: z.ZodDefault<z.ZodString>;
    /**
     * Token lifetime in seconds (optional)
     */
    expires_in: z.ZodOptional<z.ZodNumber>;
    /**
     * Refresh token (optional)
     */
    refresh_token: z.ZodOptional<z.ZodString>;
    /**
     * Scope of the access token (optional)
     * If omitted, same as requested scope
     */
    scope: z.ZodOptional<z.ZodString>;
    /**
     * Resource indicators (RFC 8707) - optional
     * List of resources this token is valid for
     */
    resource: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>>;
}, z.ZodTypeAny, "passthrough">>;
/**
 * Inferred TypeScript type from the schema
 */
export type TokenResponse = z.infer<typeof TokenResponseSchema>;
/**
 * Token Error Response (RFC 6749 Section 5.2)
 */
export declare const TokenErrorResponseSchema: z.ZodObject<{
    /**
     * Error code
     */
    error: z.ZodEnum<["invalid_request", "invalid_client", "invalid_grant", "unauthorized_client", "unsupported_grant_type", "invalid_scope"]>;
    /**
     * Human-readable error description (optional)
     */
    error_description: z.ZodOptional<z.ZodString>;
    /**
     * URI to error documentation (optional)
     */
    error_uri: z.ZodOptional<z.ZodString>;
}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
    /**
     * Error code
     */
    error: z.ZodEnum<["invalid_request", "invalid_client", "invalid_grant", "unauthorized_client", "unsupported_grant_type", "invalid_scope"]>;
    /**
     * Human-readable error description (optional)
     */
    error_description: z.ZodOptional<z.ZodString>;
    /**
     * URI to error documentation (optional)
     */
    error_uri: z.ZodOptional<z.ZodString>;
}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
    /**
     * Error code
     */
    error: z.ZodEnum<["invalid_request", "invalid_client", "invalid_grant", "unauthorized_client", "unsupported_grant_type", "invalid_scope"]>;
    /**
     * Human-readable error description (optional)
     */
    error_description: z.ZodOptional<z.ZodString>;
    /**
     * URI to error documentation (optional)
     */
    error_uri: z.ZodOptional<z.ZodString>;
}, z.ZodTypeAny, "passthrough">>;
/**
 * Inferred TypeScript type from the schema
 */
export type TokenErrorResponse = z.infer<typeof TokenErrorResponseSchema>;
/**
 * Validate token audience matches expected resource
 *
 * @param claims - JWT access token claims
 * @param expectedResource - Expected resource URL (MCP server)
 * @returns true if audience includes the expected resource
 */
export declare function validateAudience(claims: JWTAccessTokenClaims, expectedResource: string): boolean;
/**
 * Check if token is expired
 *
 * @param claims - JWT access token claims
 * @param clockSkewSeconds - Allow for clock skew (default: 60 seconds)
 * @returns true if token is expired
 */
export declare function isTokenExpired(claims: JWTAccessTokenClaims, clockSkewSeconds?: number): boolean;
/**
 * Check if token is not yet valid (nbf check)
 *
 * @param claims - JWT access token claims
 * @param clockSkewSeconds - Allow for clock skew (default: 60 seconds)
 * @returns true if token is not yet valid
 */
export declare function isTokenNotYetValid(claims: JWTAccessTokenClaims, clockSkewSeconds?: number): boolean;
/**
 * Parse scope string into array of individual scopes
 *
 * @param scope - Space-separated scope string
 * @returns Array of scope values
 */
export declare function parseScopes(scope?: string): string[];
/**
 * Check if token has a specific scope
 *
 * @param claims - JWT access token claims
 * @param requiredScope - The scope to check for
 * @returns true if token has the required scope
 */
export declare function hasScope(claims: JWTAccessTokenClaims, requiredScope: string): boolean;
//# sourceMappingURL=token.d.ts.map