/**
 * Authorization for authenticated Builder.io requests.
 *
 * Two credential kinds reach these endpoints and they are not interchangeable:
 * a legacy `bpk-` private key bypasses Builder's OAuth scope middleware
 * entirely, while an OAuth access token is checked against the scopes its
 * grant was issued with. New Builder connections store only an OAuth grant, so
 * every authenticated Builder caller must share this precedence decision.
 */
import { type RemoteMcpScope } from "../mcp-client/remote-store.js";
import { type BuilderOAuthPermissionScope } from "./builder-oauth.js";
export declare function isBuilderReauthorizationRequired(error: unknown): boolean;
export type BuilderLegacyCredentialKey = "BUILDER_PRIVATE_KEY" | "BUILDER_CMS_PRIVATE_KEY";
export declare const BUILDER_PUBLISH_MCP_RESOURCE = "https://mcp.builder.io/mcp/publish";
export interface BuilderRequestAuthorization {
    token: string;
    authorization: string;
    source: "oauth" | "legacy";
    oauthScope?: RemoteMcpScope;
    oauthResource?: "general" | "publish";
    oauthConnectionId?: string;
    /**
     * Space selected during Builder OAuth. This is only a request locator; the
     * provider must verify the token and reject a different apiKey.
     */
    oauthSelectedPublicKey?: string;
    legacyCredentialKey?: BuilderLegacyCredentialKey;
    legacyPublicKey?: string;
    userId?: string;
}
export declare function resolveBuilderRequestAuthorization(input?: {
    requiredScope?: BuilderOAuthPermissionScope;
    oauthResource?: "general" | "publish";
    legacyCredentialKeys?: readonly BuilderLegacyCredentialKey[];
    /** Refresh the OAuth access token even though it has not expired. */
    forceRefresh?: boolean;
}): Promise<BuilderRequestAuthorization | null>;
/**
 * Resolve a legacy Builder key authorization, skipping OAuth entirely.
 *
 * Only for Builder surfaces that cannot accept an OAuth bearer token at all.
 * Every other caller must go through `resolveBuilderRequestAuthorization` so a
 * user's grant wins over a deploy-level key.
 */
export declare function resolveBuilderLegacyRequestAuthorization(legacyCredentialKeys?: readonly BuilderLegacyCredentialKey[]): Promise<BuilderRequestAuthorization | null>;
/**
 * Resolve the `Authorization` header for a Builder asset API call.
 *
 * OAuth wins whenever the request's owner has a grant. An unusable grant
 * throws rather than falling back to a private key: falling back would let a
 * deploy-level or stale `bpk-` key act for a user who never authorized it.
 *
 * @param requiredScope OAuth scope the endpoint enforces. Omit for endpoints
 * with no scope gate.
 */
export declare function resolveBuilderApiAuthorization(requiredScope?: BuilderOAuthPermissionScope, options?: {
    forceRefresh?: boolean;
}): Promise<string>;
export declare function hasBuilderApiCredentialCustody(): Promise<boolean>;
export declare function canAuthorizeBuilderApiRequest(requiredScope?: BuilderOAuthPermissionScope): Promise<boolean>;