import type { OAuthTokenVerifier } from '@modelcontextprotocol/sdk/server/auth/provider.js';
import type { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';
import type { OAuthMetadata } from '@modelcontextprotocol/sdk/shared/auth.js';
import type { McpEnv } from './config.js';
/** Who is calling — available to every tool via `extra.authInfo.extra`. */
export interface Caller {
    subject: string;
    clientId: string;
    scopes: string[];
}
export declare const callerOf: (auth: AuthInfo | undefined) => Caller;
/** Fetch the IdP's authorization-server metadata (RFC 8414, falling back to OIDC discovery). */
export declare function discoverIssuer(issuer: string): Promise<OAuthMetadata>;
/** Validates IdP-issued JWT access tokens: signature (JWKS), issuer, audience = this MCP server, expiry. */
export declare function jwtVerifier(env: McpEnv, metadata: OAuthMetadata): OAuthTokenVerifier;
/** Dev/testing only: fixed tokens from MCP_STATIC_TOKENS. Refused in production by config validation. */
export declare function staticVerifier(spec: string): OAuthTokenVerifier;
//# sourceMappingURL=auth.d.ts.map