import { z } from "@hono/zod-openapi";
import { Client } from "@authhero/adapter-interfaces";
import { SsrfFetchOptions } from "../utils/ssrf-fetch";
/**
 * Cheap guard: a CIMD client_id is an absolute https/http URL. Full validation
 * (length, path, fetch, document shape) happens in {@link resolveCimdClient}.
 */
export declare function isCimdClientId(clientId: string): boolean;
export declare const cimdDocumentSchema: z.ZodObject<{
    client_id: z.ZodString;
    client_name: z.ZodString;
    grant_types: z.ZodArray<z.ZodString>;
    redirect_uris: z.ZodOptional<z.ZodArray<z.ZodString>>;
    application_type: z.ZodOptional<z.ZodEnum<{
        native: "native";
        web: "web";
    }>>;
    token_endpoint_auth_method: z.ZodOptional<z.ZodEnum<{
        none: "none";
        private_key_jwt: "private_key_jwt";
    }>>;
    jwks_uri: z.ZodOptional<z.ZodString>;
}, z.core.$strip>;
export type CimdDocument = z.infer<typeof cimdDocumentSchema>;
/**
 * Fetch, validate, and map a CIMD document into a synthesized (un-persisted)
 * Client. The caller is responsible for the per-tenant flag check and for
 * composing tenant + connections into an EnrichedClient.
 *
 * @throws JSONHTTPException(400) on any URL, fetch, or document validation error.
 */
export declare function resolveCimdClient(rawUrl: string, fetchOpts?: SsrfFetchOptions): Promise<Client>;
