/**
 * memory-journal-mcp — OAuth Protected Resource Server (RFC 9728)
 *
 * Implements the OAuth 2.0 Protected Resource Metadata endpoint
 * as specified in RFC 9728.
 *
 * @see https://datatracker.ietf.org/doc/html/rfc9728
 */
import type { RequestHandler } from 'express';
import type { ProtectedResourceMetadata, ResourceServerConfig } from './types.js';
/**
 * OAuth 2.0 Protected Resource Server
 *
 * Provides Protected Resource Metadata (RFC 9728) for MCP authorization.
 */
export declare class OAuthResourceServer {
    private readonly config;
    private metadata;
    constructor(config: ResourceServerConfig);
    /**
     * Get the Protected Resource Metadata document
     *
     * @returns RFC 9728 compliant metadata
     */
    getMetadata(): ProtectedResourceMetadata;
    /**
     * Build the Protected Resource Metadata document
     */
    private buildMetadata;
    /**
     * Get Express request handler for the metadata endpoint
     *
     * Serves: GET /.well-known/oauth-protected-resource
     */
    getMetadataHandler(): RequestHandler;
    /**
     * Generate WWW-Authenticate header for 401 responses
     *
     * @param error - Error type for the header
     * @param errorDescription - Human-readable error description
     * @returns WWW-Authenticate header value
     */
    getWWWAuthenticateHeader(error?: string, errorDescription?: string): string;
    /**
     * Get the resource URI
     */
    getResourceUri(): string;
    /**
     * Get the authorization servers
     */
    getAuthorizationServers(): string[];
    /**
     * Get supported scopes
     */
    getSupportedScopes(): string[];
    /**
     * Check if a scope is supported by this resource server.
     */
    isScopeSupported(scope: string): boolean;
    /**
     * Get the well-known metadata endpoint path
     */
    getWellKnownPath(): string;
    /**
     * Clear cached metadata (useful when configuration changes)
     */
    clearCache(): void;
}
/**
 * Create an OAuth Resource Server instance
 */
export declare function createOAuthResourceServer(config: ResourceServerConfig): OAuthResourceServer;
//# sourceMappingURL=oauth-resource-server.d.ts.map