import type { StoredOAuthClientInformation } from "@modelcontextprotocol/client";
import { type H3Event } from "h3";
import { type McpOAuthCredentialBundle, type McpOAuthDiscoveryState } from "./oauth-client.js";
import { type McpPrincipal } from "./principal.js";
import { type StoredRemoteMcpServer, type RemoteMcpScope } from "./remote-store.js";
export declare function resolveTrustedMcpOAuthAuthorizationScope(serverUrl: URL): string | undefined;
export type McpOAuthScopeViolation = "organization-scope-required" | "personal-scope-required";
export type McpOAuthScopeResolution = {
    ok: true;
    scope: RemoteMcpScope;
} | {
    ok: false;
    violation: McpOAuthScopeViolation;
};
export interface McpOAuthFlow {
    name: string;
    url: string;
    description?: string;
    scope: RemoteMcpScope;
    scopeId: string;
    owner: string;
    orgId?: string;
    redirectUri: string;
    state: string;
    codeVerifier: string;
    clientInformation: StoredOAuthClientInformation;
    discoveryState?: McpOAuthDiscoveryState;
    authorizationScope?: string;
    returnUrl?: string;
    replaceServerId?: string;
    expiresAt: number;
}
export interface McpOAuthRoutesOptions {
    reconfigure: (target: {
        scope: RemoteMcpScope;
        scopeId: string;
        server: StoredRemoteMcpServer;
        principal: McpPrincipal;
    }) => Promise<boolean>;
}
export declare function resolveMcpOAuthReturnPath(connected: boolean, flow: Pick<McpOAuthFlow, "name" | "returnUrl">): string;
export declare function bindMcpOAuthAuthorizationScope(flow: Pick<McpOAuthFlow, "authorizationScope">, credentials: McpOAuthCredentialBundle): McpOAuthCredentialBundle;
export declare function withStagedCookies(event: H3Event, response: Response): Response;
export declare function redirectWithStagedCookies(event: H3Event, location: string): Response;
export declare function mountMcpOAuthRoutes(nitroApp: any, options: McpOAuthRoutesOptions): void;
export declare const MCP_OAUTH_MANAGED_CLIENT_MISSING_MESSAGE = "Managed MCP OAuth is not configured for this workspace. A workspace owner must register the OAuth client once; after that, any workspace member can connect a personal account.";
export type McpOAuthStartErrorBody = {
    error: string;
    errorCode?: string;
    retryable?: boolean;
};
export declare function describeMcpOAuthRegistrationUnsupported(authorizationServer: string | undefined): string;
export declare function resolveMcpOAuthStartError(error: unknown): {
    status: 400 | 503;
    body: McpOAuthStartErrorBody;
};
export declare function mcpOAuthStartFailureResponse(event: H3Event, failure: {
    status: number;
    body: McpOAuthStartErrorBody;
}, htmlOptions?: {
    backHref?: string;
    backLabel?: string;
}): Response | Record<string, unknown>;
export declare function wantsHtmlResponse(event: H3Event): boolean;
export declare function resolveMcpOAuthScope(serverUrl: URL, requestedScope: unknown, options?: {
    allowManagedOrgReconnect?: boolean;
}): McpOAuthScopeResolution;
export declare function describeMcpOAuthScopeViolation(violation: McpOAuthScopeViolation): string;
export declare function stripMcpOAuthAppBasePath(path: string, basePath: string): string;
export declare function resolveManagedMcpOAuthClient(serverUrl: URL): Promise<StoredOAuthClientInformation | undefined>;
export declare function setMcpOAuthFlowCookie(event: H3Event, flow: McpOAuthFlow, secure: boolean): void;
export declare function readMcpOAuthFlowCookie(event: H3Event): McpOAuthFlow | null;
export declare function clearMcpOAuthFlowCookies(event: H3Event): void;
export declare function isValidMcpOAuthFlow(flow: McpOAuthFlow, email: string, orgId: string | undefined, state: string): boolean;