/**
 * MCP Auth Flow
 *
 * High-level OAuth flow management using the MCP SDK's built-in auth functions.
 */
import { type StoredTokens } from "./mcp-auth.js";
import type { ServerEntry } from "./types.js";
/**
 * Validation/startup errors thrown by the MCP OAuth entry points. The relay
 * handler maps these to `BadRequestError` (HTTP 400); the agent tool surfaces
 * the message as tool output.
 *
 * Defined here (rather than in mcp-auth-start.ts) because `startAuth` in this
 * module throws it too — mcp-auth-start.ts re-exports it, so existing
 * imports from mcp-auth-start.js keep working without a circular-import
 * change (the two modules already reference each other via
 * `inFlightMcpAuths`, and this re-export rides that existing edge).
 */
export declare class McpAuthStartError extends Error {
    constructor(message: string, options?: ErrorOptions);
}
/** Auth status for a server */
export type AuthStatus = "authenticated" | "expired" | "not_authenticated" | "in_progress";
/**
 * Start OAuth authentication flow for a server.
 * Returns the authorization URL when browser authorization is required.
 * Also returns the OAuth `state` parameter that was generated and persisted
 * for this flow, so headless callers (e.g. the `/api/mcp-auth` handler) can
 * wait for the callback without re-reading it from storage.
 */
export declare function startAuth(serverName: string, serverUrl: string, definition?: ServerEntry): Promise<{
    authorizationUrl: string;
    oauthState?: string;
}>;
/**
 * Complete OAuth authentication with the authorization code.
 */
export declare function completeAuth(serverName: string, authorizationCode: string): Promise<AuthStatus>;
/**
 * Perform the complete OAuth authentication flow for a server.
 *
 * @param serverName - The name of the MCP server
 * @param serverUrl - The URL of the MCP server
 * @param definition - The server definition (optional)
 * @returns The final auth status
 */
export declare function authenticate(serverName: string, serverUrl: string, definition?: ServerEntry): Promise<AuthStatus>;
/**
 * Get a valid access token for a server, refreshing if necessary.
 *
 * @param serverName - The name of the MCP server
 * @param serverUrl - The URL of the MCP server
 * @param definition - The server definition (optional). When provided, the
 *   refresh provider is built from the real OAuth config so a
 *   pre-registered client (clientId/clientSecret/scope) is available
 *   during the refresh; without it, behavior is unchanged.
 * @returns The valid tokens or null if not authenticated
 */
export declare function getValidToken(serverName: string, serverUrl: string, definition?: ServerEntry): Promise<StoredTokens | null>;
/**
 * Check the authentication status for a server.
 *
 * @param serverName - The name of the MCP server
 * @returns The current auth status
 */
export declare function getAuthStatus(serverName: string): Promise<AuthStatus>;
/**
 * Remove all OAuth credentials for a server.
 *
 * @param serverName - The name of the MCP server
 */
export declare function removeAuth(serverName: string): Promise<void>;
/**
 * Check if OAuth is supported for a server configuration.
 * OAuth is supported for HTTP servers unless explicitly disabled.
 *
 * @param definition - The server definition
 * @returns True if OAuth is supported
 */
export declare function supportsOAuth(definition: ServerEntry): boolean;
/**
 * Initialize the OAuth system on startup.
 * Starts the callback server if there are any OAuth servers configured.
 */
export declare function initializeOAuth(): Promise<void>;
/**
 * Shutdown the OAuth system.
 * Stops the callback server and cancels pending auths.
 */
export declare function shutdownOAuth(): Promise<void>;
//# sourceMappingURL=mcp-auth-flow.d.ts.map