/**
 * SQL-backed storage for standard remote MCP OAuth.
 *
 * Additive framework tables only. We store OAuth client registrations,
 * short-lived authorization codes, and hashed refresh tokens. Access tokens
 * are signed JWTs and are never persisted.
 */
export declare const MCP_OAUTH_CODE_TTL_MS: number;
/**
 * Access-token TTL as a jose-compatible duration string.
 * Defaults to "30d"; override with MCP_OAUTH_ACCESS_TOKEN_TTL env var.
 */
export declare const MCP_OAUTH_ACCESS_TOKEN_TTL: string;
/**
 * Access-token TTL in seconds (derived from the same env var).
 * Used to populate the OAuth `expires_in` response field.
 */
export declare const MCP_OAUTH_ACCESS_TOKEN_TTL_SECONDS: number;
export declare const MCP_OAUTH_REFRESH_TOKEN_TTL_MS: number;
export declare const MCP_OAUTH_REGISTER_MAX = 60;
export declare const MCP_OAUTH_REGISTER_WINDOW_MS = 60000;
export interface OAuthClientRow {
    clientId: string;
    clientName: string | null;
    redirectUris: string[];
    grantTypes: string[];
    responseTypes: string[];
    tokenEndpointAuthMethod: string;
    createdAt: number | null;
}
export interface OAuthCodeRow {
    code: string;
    clientId: string;
    redirectUri: string;
    codeChallenge: string;
    codeChallengeMethod: string;
    ownerEmail: string;
    orgId: string | null;
    orgDomain: string | null;
    scope: string;
    resource: string;
    createdAt: number | null;
    expiresAt: number | null;
    consumedAt: number | null;
}
export interface OAuthRefreshTokenRow {
    id: string;
    tokenHash: string;
    clientId: string;
    ownerEmail: string;
    orgId: string | null;
    orgDomain: string | null;
    scope: string;
    resource: string;
    createdAt: number | null;
    expiresAt: number | null;
    lastUsedAt: number | null;
    revokedAt: number | null;
    replacedByHash: string | null;
}
export declare function generateOpaqueToken(): string;
export declare function hashOAuthToken(token: string): string;
export declare function registerOAuthClient(params: {
    clientName?: string | null;
    redirectUris: string[];
    grantTypes?: string[];
    responseTypes?: string[];
    tokenEndpointAuthMethod?: string;
}): Promise<OAuthClientRow>;
export declare function getOAuthClient(clientId: string): Promise<OAuthClientRow | null>;
export declare function createOAuthCode(params: {
    clientId: string;
    redirectUri: string;
    codeChallenge: string;
    codeChallengeMethod: string;
    ownerEmail: string;
    orgId?: string | null;
    orgDomain?: string | null;
    scope: string;
    resource: string;
}): Promise<OAuthCodeRow>;
export declare function getOAuthCode(code: string): Promise<OAuthCodeRow | null>;
export declare function consumeOAuthCode(code: string): Promise<OAuthCodeRow | null>;
export declare function createOAuthRefreshToken(params: {
    refreshToken: string;
    clientId: string;
    ownerEmail: string;
    orgId?: string | null;
    orgDomain?: string | null;
    scope: string;
    resource: string;
}): Promise<OAuthRefreshTokenRow>;
export declare function rotateOAuthRefreshToken(params: {
    oldRefreshToken: string;
    newRefreshToken: string;
}): Promise<OAuthRefreshTokenRow | null>;
export declare function getOAuthRefreshToken(refreshToken: string): Promise<OAuthRefreshTokenRow | null>;
/**
 * Slide the refresh-token's expiry window on each successful use so that active
 * users never hit the TTL. Records `last_used_at` and extends `expires_at` to
 * `now + MCP_OAUTH_REFRESH_TOKEN_TTL_MS`.
 */
export declare function touchOAuthRefreshToken(refreshToken: string): Promise<void>;
//# sourceMappingURL=oauth-store.d.ts.map