/**
 * Standard remote MCP OAuth 2.1 endpoints.
 *
 * These routes let MCP hosts such as Claude Code and ChatGPT authenticate
 * through their native remote-MCP OAuth flow instead of pasting bearer tokens.
 * The issued access tokens are audience-bound to `/mcp`, carry
 * the same user/org identity as the existing connect flow, and are mediated by
 * `verifyAuth` before any MCP tool/resource request runs.
 */
import type { H3Event } from "h3";
export interface McpOAuthRouteOptions {
    appId?: string;
    appName?: string;
}
export declare function getMcpOAuthIssuer(event: H3Event): string | undefined;
export declare function getMcpOAuthResource(event: H3Event): string | undefined;
/**
 * All plausible MCP OAuth resource audiences for the given request, deduped.
 *
 * When a configured public base URL differs from the request-derived origin
 * (e.g. during Netlify deploy-preview or behind a reverse proxy), a token
 * minted against the configured URL must still verify against the request-
 * derived URL and vice-versa.  Returns both so `verifyMcpOAuthAccessToken`
 * accepts either without issuing a 401.
 */
export declare function getMcpOAuthAudiences(event: H3Event): string[];
export declare function getMcpOAuthProtectedResourceMetadataUrl(event: H3Event): string | undefined;
export declare function buildMcpOAuthChallenge(event: H3Event): string;
export declare function handleMcpOAuthProtectedResourceMetadata(event: H3Event): Response;
export declare function handleMcpOAuthAuthorizationServerMetadata(event: H3Event): Response;
export declare function handleMcpOAuth(event: H3Event, subpath: string, options?: McpOAuthRouteOptions): Promise<Response>;
//# sourceMappingURL=oauth-route.d.ts.map