import { type McpOAuthCredentialBundle } from "../mcp-client/oauth-client.js";
export declare const BUILDER_OAUTH_ISSUER = "https://mcp.builder.io";
export declare const BUILDER_OAUTH_RESOURCE = "https://api.builder.io";
export declare const BUILDER_OAUTH_SCOPE = "builder:ai:invoke";
export declare const BUILDER_ASSETS_WRITE_SCOPE = "builder:assets:write";
export declare const BUILDER_CONTENT_READ_SCOPE = "builder:content:read";
export declare const BUILDER_CONTENT_WRITE_SCOPE = "builder:content:write";
export declare const BUILDER_OAUTH_SCOPES: readonly ["builder:ai:invoke", "builder:agents:run", "builder:browser:connect", "builder:assets:write", "builder:content:read", "builder:content:write", "builder:projects:read", "builder:projects:write", "builder:designsystem:read", "builder:designsystem:write"];
export type BuilderOAuthPermissionScope = (typeof BUILDER_OAUTH_SCOPES)[number];
export type BuilderOAuthPendingFlow = {
    codeVerifier: string;
    clientInformation: unknown;
    discoveryState?: unknown;
    redirectUri: string;
};
export type BuilderOAuthScope = "user" | "org";
/**
 * A Builder.io connection as people see it: the organization's shared one, or
 * a member's personal one. Stored as the `org` and `user` OAuth scopes.
 */
export type BuilderConnectionScope = "org" | "personal";
export declare function builderOAuthScopeFor(scope: BuilderConnectionScope): BuilderOAuthScope;
export declare function builderConnectionScopeFor(scope: BuilderOAuthScope): BuilderConnectionScope;
export declare function isBuilderOrgManagerRole(role: string | null | undefined): boolean;
/**
 * Owners and admins connect Builder.io for the organization, so they get no
 * personal connection of their own (settings-redesign open question 1). This
 * is the one predicate that encodes that call; the connect and status routes
 * both read it.
 */
export declare function canRoleConnectPersonalBuilder(role: string | null | undefined): boolean;
/**
 * Whether a member's personal Builder.io grant may be used and created. The
 * "Restrict personal API keys" org policy answers here. The reads that pick a
 * request's grant, the status route's `restricted` flag, and personal connect
 * start all call this, so the policy needs no other hook. Throws when the
 * policy cannot be read.
 */
export declare function isPersonalBuilderGrantAllowed(input: {
    ownerEmail: string;
    orgId: string | null;
}): Promise<boolean>;
export type BuilderOAuthSession = {
    accessToken: string;
    expiresAt?: number;
    scopes: string[];
    scope: BuilderOAuthScope;
    /** Opaque identity of the selected stored OAuth credential lane. */
    connectionId?: string;
};
export type BuilderOAuthRequestAccess = BuilderOAuthSession & {
    ownerEmail: string;
};
export type ResolvedBuilderOAuthRequestAccess = Omit<BuilderOAuthRequestAccess, "connectionId"> & {
    connectionId: string;
};
export declare function startBuilderOAuthAuthorization(input: {
    ownerEmail: string;
    redirectUri: string;
    state: string;
}): Promise<{
    authorizationUrl: string;
    pending: BuilderOAuthPendingFlow;
}>;
export declare function exchangeBuilderOAuthAuthorization(input: {
    ownerEmail: string;
    code: string;
    iss?: string;
    pending: BuilderOAuthPendingFlow;
}): Promise<McpOAuthCredentialBundle>;
/**
 * Store a completed grant. An explicit `scope` decides custody outright (the
 * caller has already authorized it); without one, an owner/admin role writes
 * the org grant and anyone else a personal grant.
 */
export declare function saveBuilderOAuthCredentials(input: {
    ownerEmail: string;
    orgId?: string | null;
    role?: string | null;
    scope?: BuilderOAuthScope;
    credentials: McpOAuthCredentialBundle;
}): Promise<BuilderOAuthScope>;
export declare function finishBuilderOAuthAuthorization(input: {
    ownerEmail: string;
    orgId?: string | null;
    role?: string | null;
    scope?: BuilderOAuthScope;
    code: string;
    iss?: string;
    pending: BuilderOAuthPendingFlow;
}): Promise<void>;
export declare function markBuilderOAuthReconnectRequired(ownerEmail: string, scope?: BuilderOAuthScope, orgId?: string | null): Promise<void>;
export declare function getBuilderOAuthSession(ownerEmail: string, orgId?: string | null, requiredScope?: BuilderOAuthPermissionScope, access?: {
    forceRefresh?: boolean;
    orgOnly?: boolean;
}): Promise<BuilderOAuthSession | null>;
export declare class BuilderOAuthScopeError extends Error {
    constructor(scope: BuilderOAuthPermissionScope);
}
export declare function hasBuilderOAuthSession(ownerEmail: string, orgId?: string | null, access?: {
    orgOnly?: boolean;
}): Promise<boolean>;
/**
 * Read the saved Builder grant without refreshing its access token. The
 * status route and chat preflight need a cheap readiness answer; runtime
 * dispatch owns token refresh and reports a reconnect error if refresh fails.
 */
export declare function hasUsableBuilderOAuthSessionForReadiness(ownerEmail: string, orgId?: string | null, requiredScope?: BuilderOAuthPermissionScope): Promise<boolean>;
export declare function getBuilderOAuthConnectionScope(ownerEmail: string, orgId?: string | null): Promise<BuilderOAuthScope | null>;
export declare function getBuilderOAuthStoredScope(ownerEmail: string, orgId?: string | null): Promise<BuilderOAuthScope | null>;
export interface BuilderOAuthGrantSummary {
    /** When this grant was saved; null for grants saved before that was recorded. */
    connectedAt: number | null;
    /** The grant is stored but unusable until someone reconnects it. */
    needsReconnect: boolean;
}
export interface BuilderOAuthGrants {
    org?: BuilderOAuthGrantSummary;
    personal?: BuilderOAuthGrantSummary & {
        /** Stored, but the org's personal-key restriction keeps it unused. */
        restricted: boolean;
    };
}
/**
 * Which Builder grants exist for this caller, each read on its own: the org's
 * shared grant and the caller's personal grant. Unlike the session readers,
 * one grant never hides the other here.
 */
export declare function getBuilderOAuthGrants(ownerEmail: string, orgId?: string | null): Promise<BuilderOAuthGrants>;
export declare function hasStoredBuilderOAuthGrant(ownerEmail: string, scope: BuilderOAuthScope, orgId?: string | null): Promise<boolean>;
/**
 * Which of `ownerEmails` have a personal Builder.io OAuth grant stored, in a
 * bounded number of reads. Same presence rule as `hasStoredBuilderOAuthGrant`
 * with scope "user".
 */
export declare function listUsersWithStoredBuilderOAuthGrant(ownerEmails: readonly string[]): Promise<Set<string>>;
export declare function resolveBuilderOAuthRequestAccess(input: {
    ownerEmail: string;
    requiredScope: BuilderOAuthPermissionScope;
    orgId?: string | null;
}): Promise<BuilderOAuthRequestAccess | null>;
export type BuilderOAuthRequestAccessState = {
    kind: "not_connected";
} | {
    kind: "unusable";
} | {
    kind: "available";
    access: ResolvedBuilderOAuthRequestAccess;
};
/** Resolve grant custody and request access together for model dispatch. */
export declare function resolveBuilderOAuthRequestAccessState(input: {
    ownerEmail: string;
    requiredScope: BuilderOAuthPermissionScope;
    orgId?: string | null;
    forceRefresh?: boolean;
    connectionId?: string;
}): Promise<BuilderOAuthRequestAccessState>;
export declare function deleteBuilderOAuthSession(ownerEmail: string, scope?: BuilderOAuthScope, orgId?: string | null): Promise<{
    localDeleted: boolean;
    remoteRevoked: boolean;
}>;