import type { H3Event } from "h3";
import { type BearerCredentialRefusal } from "../server/bearer-credential-refusal.js";
export interface McpOAuthRouteOptions {
    appId?: string;
    appName?: string;
}
export declare function getMcpOAuthIssuer(event: H3Event): string | undefined;
/**
 * The issuer MCP credentials are bound to, given the caller's request origin.
 * Verification accepts only this issuer's resources, so anything that mints a
 * bearer for this app must resolve its audience here, not from request headers:
 * a configured public URL wins over the host a page was reached through.
 */
export declare function resolveMcpOAuthIssuer(requestOrigin: string | undefined): string | undefined;
export declare function getMcpConnectUrl(event: H3Event): string | undefined;
export declare function getMcpOAuthResource(event: H3Event, routePath?: string): string | undefined;
/**
 * All plausible MCP OAuth resource audiences for the given request, deduped.
 *
 * When a configured public base URL differs from the request-derived origin
 * (e.g. during Netlify deploy-preview or behind a reverse proxy), a token
 * minted against the configured URL must still verify against the request-
 * derived URL and vice-versa.  Returns both so `verifyMcpOAuthAccessToken`
 * accepts either without issuing a 401.
 */
export declare function getMcpOAuthAudiences(event: H3Event, routePath?: string): string[];
export declare function getMcpOAuthProtectedResourceMetadataUrl(event: H3Event, routePath?: string): string | undefined;
/** `refusal` is set only when the request presented a bearer token. */
export declare function buildMcpOAuthChallenge(event: H3Event, routePath?: string, refusal?: BearerCredentialRefusal): string;
export declare function handleMcpOAuthProtectedResourceMetadata(event: H3Event): Response;
export declare function handleMcpOAuthAuthorizationServerMetadata(event: H3Event): Response;
export declare function handleMcpOAuth(event: H3Event, subpath: string, options?: McpOAuthRouteOptions): Promise<Response>;