/**
 * memory-journal-mcp — Token Validator
 *
 * JWT access token validation using JWKS for signature verification.
 * Supports RSA and EC algorithms commonly used with OAuth 2.0.
 */
import type { TokenValidationResult, TokenValidatorConfig } from './types.js';
import { InvalidTokenError, TokenExpiredError, InvalidSignatureError } from './errors.js';
/**
 * JWT Token Validator
 *
 * Validates OAuth 2.0 access tokens using JWKS for signature verification.
 */
export declare class TokenValidator {
    /** Resolved configuration with all defaults applied */
    private readonly jwksUri;
    private readonly issuer;
    private readonly audience;
    private readonly clockTolerance;
    private readonly jwksCacheTtl;
    private jwks;
    private jwksExpiry;
    constructor(config: TokenValidatorConfig);
    /**
     * Validate an access token
     *
     * @param token - The JWT access token
     * @returns Validation result with claims or error
     */
    validate(token: string): Promise<TokenValidationResult>;
    /**
     * Get or refresh the JWKS
     */
    private getJwks;
    /**
     * Extract and normalize token claims
     */
    private extractClaims;
    /**
     * Handle validation errors and convert to TokenValidationResult
     */
    private handleValidationError;
    /**
     * Refresh the JWKS cache
     */
    refreshJwks(): void;
    /**
     * Clear the JWKS cache
     */
    clearCache(): void;
    /**
     * Convert a validation error to the appropriate OAuth error class
     */
    static toOAuthError(result: TokenValidationResult): InvalidTokenError | TokenExpiredError | InvalidSignatureError;
    /**
     * Preload JWKS to validate availability at startup
     */
    preload(): Promise<void>;
}
/**
 * Create a Token Validator instance
 */
export declare function createTokenValidator(config: TokenValidatorConfig): TokenValidator;
//# sourceMappingURL=token-validator.d.ts.map