import { MCP_OAUTH_ACCESS_TOKEN_TTL, MCP_OAUTH_ACCESS_TOKEN_TTL_SECONDS } from "./oauth-store.js";
export { MCP_OAUTH_ACCESS_TOKEN_TTL, MCP_OAUTH_ACCESS_TOKEN_TTL_SECONDS };
export declare const MCP_OAUTH_SCOPES: readonly ["mcp:read", "mcp:write", "mcp:apps", "offline_access"];
export declare const MCP_OAUTH_DEFAULT_SCOPE: string;
export interface McpOAuthAccessTokenClaims {
    sub: string;
    org_id?: string;
    org_domain?: string;
    scope: string;
    client_id: string;
    resource: string;
    jti?: string;
    typ: "agent-native-mcp-oauth";
}
export declare function normalizeOAuthScope(input: unknown): string | null;
export declare function scopeList(scope: string | undefined): string[];
export declare function hasMcpOAuthScope(scopes: string[] | undefined, scope: (typeof MCP_OAUTH_SCOPES)[number]): boolean;
export declare function signMcpOAuthAccessToken(params: {
    ownerEmail: string;
    orgId?: string | null;
    orgDomain?: string | null;
    clientId: string;
    scope: string;
    resource: string;
    issuer: string;
    jti?: string;
    expiresIn?: string | number;
    /**
     * When `"full"`, embed a `catalog_scope: "full"` custom claim so this token
     * bypasses the compact/connector-catalog tier filter (active by default
     * whenever a `connectorCatalog` is declared). Used when the connect flow is
     * initiated with `--full-catalog`.
     */
    catalogScope?: "full";
}): Promise<string>;
export declare function verifyMcpOAuthAccessToken(token: string, resource: string | string[] | undefined): Promise<{
    userEmail: string;
    orgId?: string;
    orgDomain?: string;
    scopes: string[];
    clientId: string;
    jti?: string;
    /** Present when the token was minted with `--full-catalog`; bypasses the
     *  compact/connector-catalog tier filter (active by default whenever a
     *  `connectorCatalog` is declared) for this caller. */
    catalogScope?: "full";
} | null>;
//# sourceMappingURL=oauth-token.d.ts.map