/**
 * JWT Access Token Validator
 *
 * Validates JWT access tokens according to:
 * - RFC 9068: JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens
 * - MCP 2025-11-25: Token audience validation requirements
 */
import * as jose from 'jose';
import { JWTAccessTokenClaims } from '../types/token.js';
import { ProtocolVersion } from '../types/protocol-version.js';
export interface ValidationResult {
    compliant: boolean;
    errors: string[];
    warnings: string[];
    claims?: JWTAccessTokenClaims;
}
/**
 * JWT Access Token Validator
 * Validates tokens based on protocol version requirements
 */
export declare class TokenValidator {
    private protocolVersion;
    constructor(protocolVersion?: ProtocolVersion);
    /**
     * Decode and validate JWT access token structure (without signature verification)
     *
     * @param token - The JWT access token
     * @returns Validation result with decoded claims
     */
    decodeAndValidate(token: string): Promise<ValidationResult>;
    /**
     * Validate JWT access token with full signature verification
     *
     * @param token - The JWT access token
     * @param expectedAudience - Expected audience (MCP server URL for 2025-11-25)
     * @param expectedIssuer - Expected issuer (authorization server)
     * @param jwksUri - JWKS URI for signature verification
     * @returns Validation result
     */
    validateAccessToken(token: string, expectedAudience: string, expectedIssuer: string, jwksUri: string): Promise<ValidationResult>;
    /**
     * Validate token contains required scope
     *
     * @param token - JWT access token or claims
     * @param requiredScope - The scope to check for
     * @returns Validation result
     */
    validateScope(token: string | JWTAccessTokenClaims, requiredScope: string): Promise<ValidationResult>;
    /**
     * Validate token resource claim (RFC 8707)
     *
     * @param token - JWT access token or claims
     * @param expectedResource - Expected resource URL
     * @returns Validation result
     */
    validateResource(token: string | JWTAccessTokenClaims, expectedResource: string): Promise<ValidationResult>;
    /**
     * Extract header from JWT without validation
     *
     * @param token - JWT access token
     * @returns JWT header
     */
    decodeHeader(token: string): jose.ProtectedHeaderParameters;
}
//# sourceMappingURL=token-validator.d.ts.map