/**
 * PKCE (Proof Key for Code Exchange) Validator
 *
 * Validates PKCE support and enforcement according to:
 * - RFC 7636: Proof Key for Code Exchange
 * - MCP 2025-11-25: Requires S256 code challenge method
 */
import { ProtocolVersion } from '../types/protocol-version.js';
import { AuthorizationServerMetadata } from '../types/oauth-discovery.js';
export interface ValidationResult {
    compliant: boolean;
    errors: string[];
    warnings: string[];
}
/**
 * PKCE Validator
 * Validates PKCE configuration and enforcement based on protocol version
 */
export declare class PKCEValidator {
    private protocolVersion;
    constructor(protocolVersion?: ProtocolVersion);
    /**
     * Validate PKCE support in authorization server metadata
     *
     * @param metadata - Authorization server metadata
     * @returns Validation result with errors and warnings
     */
    validatePKCESupport(metadata: AuthorizationServerMetadata): ValidationResult;
    /**
     * Validate PKCE for MCP 2025-11-25 (S256 required)
     */
    private validateMCP2025PKCE;
    /**
     * Validate PKCE for pre-2025-11-25 (S256 or plain acceptable)
     */
    private validateLegacyPKCE;
    /**
     * Validate code challenge method parameter
     *
     * @param method - The code challenge method being used
     * @returns Validation result
     */
    validateCodeChallengeMethod(method: string): ValidationResult;
    /**
     * Validate code challenge format
     *
     * @param codeChallenge - The code challenge value
     * @param method - The code challenge method
     * @returns Validation result
     */
    validateCodeChallenge(codeChallenge: string, method: string): ValidationResult;
    /**
     * Validate code verifier format (used in token request)
     *
     * @param codeVerifier - The code verifier value
     * @returns Validation result
     */
    validateCodeVerifier(codeVerifier: string): ValidationResult;
}
//# sourceMappingURL=pkce-validator.d.ts.map