/**
 * OAuth 2.1 client support for remote MCP servers.
 *
 * MCP servers advertise their OAuth endpoints through the standard protected
 * resource and authorization-server metadata documents. The SDK handles the
 * protocol details; this module owns the framework-specific encrypted storage
 * and refresh boundary.
 */
import { type OAuthClientProvider } from "@modelcontextprotocol/sdk/client/auth.js";
import type { AuthorizationServerMetadata, OAuthClientInformationMixed, OAuthClientMetadata, OAuthProtectedResourceMetadata, OAuthTokens } from "@modelcontextprotocol/sdk/shared/auth.js";
export interface McpOAuthDiscoveryState {
    authorizationServerUrl: string;
    authorizationServerMetadata?: AuthorizationServerMetadata;
    resourceMetadata?: OAuthProtectedResourceMetadata;
    resourceMetadataUrl?: string;
}
export interface McpOAuthCredentialBundle {
    serverUrl: string;
    clientInformation: OAuthClientInformationMixed;
    discoveryState?: McpOAuthDiscoveryState;
    tokens: OAuthTokens;
    tokenExpiresAt?: number;
}
export interface McpOAuthStartResult {
    authorizationUrl: URL;
    codeVerifier: string;
    state: string;
    clientInformation: OAuthClientInformationMixed;
    discoveryState?: McpOAuthDiscoveryState;
}
export interface McpOAuthCallbackResult {
    credentials: McpOAuthCredentialBundle;
}
export interface McpOAuthProviderOptions {
    serverUrl: string;
    redirectUrl: string;
    state: string;
    clientInformation?: OAuthClientInformationMixed;
    codeVerifier?: string;
    discoveryState?: McpOAuthDiscoveryState;
}
/**
 * A small adapter around the MCP SDK's OAuth provider interface. The route
 * stores the adapter's state in an encrypted, short-lived browser cookie; the
 * durable credential bundle is written only after the callback succeeds.
 */
export declare class McpOAuthClientProvider implements OAuthClientProvider {
    private readonly redirectUrlValue;
    private readonly stateValue;
    private readonly metadata;
    private clientInfo?;
    private savedTokens?;
    private savedCodeVerifier?;
    private savedDiscovery?;
    private authorizationUrl?;
    constructor(options: McpOAuthProviderOptions);
    get redirectUrl(): string;
    get clientMetadata(): OAuthClientMetadata;
    state(): string;
    clientInformation(): OAuthClientInformationMixed | undefined;
    saveClientInformation(info: OAuthClientInformationMixed): void;
    tokens(): OAuthTokens | undefined;
    saveTokens(tokens: OAuthTokens): void;
    redirectToAuthorization(authorizationUrl: URL): void;
    saveCodeVerifier(codeVerifier: string): void;
    codeVerifier(): string;
    saveDiscoveryState(state: {
        authorizationServerUrl: string;
        authorizationServerMetadata?: AuthorizationServerMetadata;
        resourceMetadata?: OAuthProtectedResourceMetadata;
        resourceMetadataUrl?: string;
    }): void;
    discoveryState(): McpOAuthDiscoveryState | undefined;
    get authorizationRedirect(): URL | undefined;
    get savedCodeVerifierValue(): string | undefined;
    get savedTokensValue(): OAuthTokens | undefined;
    get savedClientInformation(): OAuthClientInformationMixed | undefined;
}
export declare function startMcpOAuthAuthorization(options: McpOAuthProviderOptions & {
    scope?: string;
}): Promise<McpOAuthStartResult>;
export declare function finishMcpOAuthAuthorization(options: McpOAuthProviderOptions & {
    authorizationCode: string;
}): Promise<McpOAuthCallbackResult>;
export declare function tokenExpiresAt(tokens: OAuthTokens): number | undefined;
export declare function saveMcpOAuthCredentials(options: {
    key: string;
    scope: "user" | "org";
    scopeId: string;
    credentials: McpOAuthCredentialBundle;
}): Promise<void>;
export declare function readMcpOAuthCredentials(options: {
    key: string;
    scope: "user" | "org";
    scopeId: string;
}): Promise<McpOAuthCredentialBundle | null>;
export declare function deleteMcpOAuthCredentials(options: {
    key: string;
    scope: "user" | "org";
    scopeId: string;
}): Promise<boolean>;
/**
 * Resolve an access token for the MCP manager. Refreshing happens only when a
 * token is near expiry, so ordinary manager reconfiguration does not perform
 * a network request for every connector.
 */
export declare function getMcpOAuthAccessToken(options: {
    key: string;
    scope: "user" | "org";
    scopeId: string;
    serverUrl: string;
}): Promise<string | null>;
//# sourceMappingURL=oauth-client.d.ts.map