import { type AuthorizationServerMetadata, type OAuthClientInformationContext, type OAuthClientMetadata, type OAuthClientProvider, type OAuthDiscoveryState, OAuthProtectedResourceMetadata, type StoredOAuthClientInformation, type StoredOAuthTokens, OAuthTokens } from "@modelcontextprotocol/client";
import { type OAuthCredential, type OAuthCredentialAccessResult, type OAuthCredentialState, type OAuthRevocationResult } from "../oauth-tokens/lifecycle.js";
export declare class McpOAuthRefreshUnavailableError extends Error {
    constructor();
}
export declare class McpOAuthReauthorizationRequiredError extends Error {
    constructor(message: string);
}
export declare function isGoogleWorkspaceMcpServer(value: string | URL): boolean;
export type McpOAuthDiscoveryState = OAuthDiscoveryState;
export interface McpOAuthCredentialBundle extends OAuthCredential {
    serverUrl: string;
    clientInformation: StoredOAuthClientInformation;
    discoveryState?: McpOAuthDiscoveryState;
    tokens: StoredOAuthTokens;
    tokenExpiresAt?: number;
}
export interface McpOAuthCredentialAccessBundle extends OAuthCredential {
    serverUrl: string;
    clientInformation: StoredOAuthClientInformation;
    discoveryState?: McpOAuthDiscoveryState;
    tokenExpiresAt?: number;
}
export interface McpOAuthStartResult {
    authorizationUrl: URL;
    codeVerifier: string;
    state: string;
    clientInformation: StoredOAuthClientInformation;
    discoveryState?: McpOAuthDiscoveryState;
}
export interface McpOAuthCallbackResult {
    credentials: McpOAuthCredentialBundle;
}
export interface McpOAuthProviderOptions {
    serverUrl: string;
    redirectUrl: string;
    state: string;
    tokenEndpointAuthMethod?: OAuthClientMetadata["token_endpoint_auth_method"];
    clientInformation?: StoredOAuthClientInformation;
    codeVerifier?: string;
    discoveryState?: McpOAuthDiscoveryState;
    /**
     * Runs the moment the SDK persists discovery, which is before it selects a
     * resource, resolves scope, or registers a client. Throwing here is how a
     * caller refuses a flow that discovery has already proven cannot finish.
     * Receives this provider's `clientMetadataUrl` because whether the SDK can
     * skip registration depends on it as well as on the server's metadata.
     */
    onDiscoveryState?: (state: McpOAuthDiscoveryState, clientMetadataUrl: string | undefined) => void;
}
export declare class McpOAuthClientProvider implements OAuthClientProvider {
    private readonly redirectUrlValue;
    private readonly stateValue;
    private readonly metadata;
    private clientInfo?;
    private savedTokens?;
    private savedCodeVerifier?;
    private savedDiscovery?;
    private authorizationUrl?;
    private readonly onDiscoveryState?;
    readonly clientMetadataUrl?: string;
    constructor(options: McpOAuthProviderOptions);
    get redirectUrl(): string;
    get clientMetadata(): OAuthClientMetadata;
    state(): string;
    clientInformation(context?: OAuthClientInformationContext): StoredOAuthClientInformation | undefined;
    saveClientInformation(info: StoredOAuthClientInformation, context?: OAuthClientInformationContext): void;
    tokens(context?: OAuthClientInformationContext): StoredOAuthTokens | undefined;
    saveTokens(tokens: StoredOAuthTokens, context?: OAuthClientInformationContext): void;
    redirectToAuthorization(authorizationUrl: URL): void;
    saveCodeVerifier(codeVerifier: string): void;
    codeVerifier(): string;
    saveDiscoveryState(state: {
        authorizationServerUrl: string;
        authorizationServerMetadata?: AuthorizationServerMetadata;
        resourceMetadata?: OAuthProtectedResourceMetadata;
        resourceMetadataUrl?: string;
    }): void;
    discoveryState(): McpOAuthDiscoveryState | undefined;
    get authorizationRedirect(): URL | undefined;
    get savedCodeVerifierValue(): string | undefined;
    get savedTokensValue(): OAuthTokens | undefined;
    get savedClientInformation(): StoredOAuthClientInformation | undefined;
    validateResourceURL(defaultResource: string | URL, advertised?: string): Promise<URL | undefined>;
}
/**
 * The authorization server behind this MCP endpoint cannot mint a client on
 * demand: its metadata advertises neither an RFC 7591 registration_endpoint nor
 * SEP-991 Client ID Metadata Documents. Retrying never helps, which is what
 * separates it from a transient discovery or network failure.
 */
export declare class McpOAuthRegistrationUnsupportedError extends Error {
    readonly issuer?: string;
    readonly authorizationServerUrl?: string;
    constructor(details: {
        issuer?: string;
        authorizationServerUrl?: string;
    });
}
export declare function resolveMcpOAuthAuthorizationServerUrl(value: string): Promise<string>;
export declare function resolveMcpOAuthAuthorizationServerDiscovery(value: string): Promise<McpOAuthDiscoveryState>;
export declare function startMcpOAuthAuthorization(options: McpOAuthProviderOptions & {
    scope?: string;
    resourceMetadataUrl?: string;
}): Promise<McpOAuthStartResult>;
export declare function finishMcpOAuthAuthorization(options: McpOAuthProviderOptions & {
    authorizationCode: string;
    iss?: string;
}): Promise<McpOAuthCallbackResult>;
export declare function validateMcpOAuthCallbackIssuer(discoveryState: McpOAuthDiscoveryState | undefined, iss: string | undefined): void;
export declare function tokenExpiresAt(tokens: OAuthTokens): number | undefined;
export declare function saveMcpOAuthCredentials(options: {
    key: string;
    scope: "user" | "org";
    scopeId: string;
    credentials: McpOAuthCredentialBundle;
}): Promise<void>;
export declare function readMcpOAuthCredentials(options: {
    key: string;
    scope: "user" | "org";
    scopeId: string;
    serverUrl?: string;
}): Promise<McpOAuthCredentialBundle | null>;
export declare function getMcpOAuthConnectionState(options: {
    key: string;
    scope: "user" | "org";
    scopeId: string;
    serverUrl: string;
}): Promise<OAuthCredentialState<McpOAuthCredentialBundle>>;
export declare function markMcpOAuthReconnectRequired(options: {
    key: string;
    scope: "user" | "org";
    scopeId: string;
    serverUrl: string;
}): Promise<boolean>;
export declare function deleteMcpOAuthCredentials(options: {
    key: string;
    scope: "user" | "org";
    scopeId: string;
    serverUrl?: string;
}): Promise<boolean>;
export declare function revokeMcpOAuthCredentials(options: {
    key: string;
    scope: "user" | "org";
    scopeId: string;
    serverUrl: string;
}): Promise<OAuthRevocationResult>;
/**
 * Resolve an access token for the MCP manager. Refreshing happens only when a
 * token is near expiry, so ordinary manager reconfiguration does not perform
 * a network request for every connector. `forceRefresh` is for a caller whose
 * request was just refused with 401 by a token that had not expired yet.
 */
export declare function resolveMcpOAuthCredentialAccess(options: {
    key: string;
    scope: "user" | "org";
    scopeId: string;
    serverUrl: string;
    forceRefresh?: boolean;
    shouldMarkReconnectRequiredOnRefreshFailure?: (error: unknown) => boolean;
}): Promise<OAuthCredentialAccessResult<McpOAuthCredentialAccessBundle>>;
export declare function getMcpOAuthAccessToken(options: {
    key: string;
    scope: "user" | "org";
    scopeId: string;
    serverUrl: string;
    forceRefresh?: boolean;
    throwOnTransientRefreshFailure?: boolean;
    shouldMarkReconnectRequiredOnRefreshFailure?: (error: unknown) => boolean;
}): Promise<string | null>;