/**
 * MCP Auth Start — shared, non-blocking OAuth flow starter.
 *
 * Single code path used by:
 *   - the relay handler (`POST /api/mcp-auth`)
 *   - the agent-facing `mcp` tool (`auth` action) and `connect` auto-trigger
 *
 * The flow is non-blocking: `startAuth` captures the authorization URL, and
 * the local callback server completes the exchange in the background
 * (waitForCallback → completeAuth → reloadMcpConfig).
 */
import { McpAuthStartError } from "./mcp-auth-flow.js";
import type { McpExtensionState } from "./state.js";
/**
 * Validation/in-flight errors thrown by `startMcpAuthFlow`. Defined in
 * mcp-auth-flow.js (its `startAuth` throws the same type for DCR failures)
 * and re-exported here so existing imports keep working.
 */
export { McpAuthStartError };
export interface StartMcpAuthFlowOptions {
    /** Best-effort: open the authorization URL in the system browser. */
    openBrowser?: boolean;
}
export type StartMcpAuthFlowResult = {
    status: "already-authenticated";
} | {
    status: "auth_url_ready";
    authUrl: string;
    openedBrowser: boolean;
};
/**
 * Per-server in-flight guard. `startAuth` keys its pending transports and
 * persisted OAuth state by server name, so two concurrent flows for the same
 * server would clobber each other. Reject the second start until the first
 * flow's background chain finishes.
 */
export declare const inFlightMcpAuths: Set<string>;
/**
 * An authorization URL may be opened in a real browser, so it must never be
 * a `javascript:` / `data:` / malformed URL coming from a malicious MCP
 * server's OAuth metadata. Defense in depth: the landing UI applies the
 * same check before `window.open`.
 */
export declare function assertSafeAuthorizationUrl(authUrl: string): void;
/**
 * Start a non-blocking OAuth flow for a configured MCP server.
 *
 * - Looks up the server definition (throws `McpAuthStartError` when missing,
 *   not OAuth-capable, or url-less).
 * - Enforces the per-server in-flight guard.
 * - Calls `startAuth`: an empty `authorizationUrl` means the server is
 *   already authenticated (or was via client_credentials).
 * - Optionally opens the authorization URL in the system browser
 *   (best-effort — a failed `open` never fails the call).
 * - Kicks off the background completion chain
 *   (waitForCallback → completeAuth → reloadMcpConfig) fire-and-forget.
 *
 * @param state - The live MCP extension state (config + reload target).
 * @param name - Configured MCP server name.
 * @param opts - `openBrowser` to launch the system browser on the auth URL.
 */
export declare function startMcpAuthFlow(state: McpExtensionState, name: string, opts?: StartMcpAuthFlowOptions): Promise<StartMcpAuthFlowResult>;
//# sourceMappingURL=mcp-auth-start.d.ts.map