import { MCP_OAUTH_ACCESS_TOKEN_TTL, MCP_OAUTH_ACCESS_TOKEN_TTL_SECONDS } from "./oauth-store.js";
export { MCP_OAUTH_ACCESS_TOKEN_TTL, MCP_OAUTH_ACCESS_TOKEN_TTL_SECONDS };
export declare const MCP_OAUTH_SCOPES: readonly ["mcp:read", "mcp:write", "mcp:apps", "offline_access"];
export declare const MCP_OAUTH_DEFAULT_SCOPE: string;
export declare const MCP_OAUTH_TOKEN_TYPE = "agent-native-mcp-oauth";
declare const MCP_OAUTH_CREDENTIAL_VERSION = 2;
/**
 * Service credentials carry a version that verifiers predating service
 * identity assurance reject. Those verifiers admit any MCP OAuth token as a
 * verified user, so a service token they accepted could approve gated actions.
 * Never sign a service credential with `MCP_OAUTH_CREDENTIAL_VERSION`.
 */
declare const MCP_OAUTH_SERVICE_CREDENTIAL_VERSION = 3;
export interface McpOAuthAccessTokenClaims {
    sub: string;
    org_id?: string | null;
    org_domain?: string;
    scope: string;
    client_id: string;
    resource: string;
    grant_created_at_ms?: number;
    jti?: string;
    typ: typeof MCP_OAUTH_TOKEN_TYPE;
    credential_version: typeof MCP_OAUTH_CREDENTIAL_VERSION | typeof MCP_OAUTH_SERVICE_CREDENTIAL_VERSION;
}
export declare function normalizeOAuthScope(input: unknown): string | null;
export declare function scopeList(scope: string | undefined): string[];
export declare function hasMcpOAuthScope(scopes: string[] | undefined, scope: (typeof MCP_OAUTH_SCOPES)[number]): boolean;
export declare function parseMcpOAuthOrgIdClaim(payload: Record<string, unknown>): {
    orgId: string | null | undefined;
} | null;
export declare function signMcpOAuthAccessToken(params: {
    ownerEmail: string;
    orgId?: string | null;
    orgDomain?: string | null;
    clientId: string;
    scope: string;
    resource: string;
    issuer: string;
    /** Immutable server-recorded creation time of the OAuth grant, in ms. */
    grantCreatedAtMs?: number | null;
    jti?: string;
    expiresIn?: string | number;
    catalogScope?: "full";
    /** An org service identity, not a person. */
    service?: true;
}): Promise<string>;
export declare function verifyMcpOAuthAccessToken(token: string, resource: string | string[] | undefined): Promise<{
    userEmail: string;
    orgId?: string | null;
    orgDomain?: string;
    scopes: string[];
    clientId: string;
    jti?: string;
    /** Immutable OAuth grant creation time, in milliseconds. */
    grantCreatedAtMs?: number;
    catalogScope?: "full";
    /** `iat`, in seconds. */
    issuedAt?: number;
} | null>;