import { A as ApiDataInterface } from './ApiDataInterface-BcZeXy5X.js';

/**
 * OAuth client application interface
 * Represents a registered OAuth application that can request access tokens
 */
interface OAuthClientInterface extends ApiDataInterface {
    /** The public client identifier (UUID format) */
    get clientId(): string;
    /** Human-readable application name */
    get name(): string;
    /** Optional description of the application */
    get description(): string | undefined;
    /** Array of allowed redirect URIs (exact match validation) */
    get redirectUris(): string[];
    /** Array of scopes this client can request */
    get allowedScopes(): string[];
    /** Supported grant types (authorization_code, client_credentials, refresh_token) */
    get allowedGrantTypes(): string[];
    /** True for server-side apps (can keep secret secure), false for mobile/desktop apps */
    get isConfidential(): boolean;
    /** Whether the client is currently active */
    get isActive(): boolean;
    /** When the client was created */
    get createdAt(): Date;
    /** When the client was last updated */
    get updatedAt(): Date;
}
/**
 * Input type for OAuth client CRUD operations
 */
type OAuthClientInput = {
    id?: string;
    name?: string;
    description?: string;
    redirectUris?: string[];
    allowedScopes?: string[];
    allowedGrantTypes?: string[];
    isConfidential?: boolean;
    isActive?: boolean;
};
/**
 * Request body for creating a new OAuth client
 */
interface OAuthClientCreateRequest {
    /** Required: Human-readable application name */
    name: string;
    /** Optional: Description of the application */
    description?: string;
    /** Required: At least one redirect URI */
    redirectUris: string[];
    /** Required: Array of scopes the client needs */
    allowedScopes: string[];
    /** Optional: Grant types (defaults to authorization_code + refresh_token) */
    allowedGrantTypes?: string[];
    /** Required: Whether this is a confidential client */
    isConfidential: boolean;
}
/**
 * Response when creating a client (includes one-time secret)
 */
interface OAuthClientCreateResponse {
    client: OAuthClientInterface;
    /** Only returned on creation - must be saved immediately */
    clientSecret?: string;
}
/**
 * Parameters for the OAuth authorization consent flow
 * Passed via URL query parameters to the consent page
 */
interface OAuthConsentRequest {
    /** The client_id requesting authorization */
    clientId: string;
    /** Where to redirect after authorization */
    redirectUri: string;
    /**
     * Space-separated list of requested scopes. Optional per RFC 6749 §3.3 —
     * when omitted, the authorization server defaults to the client's
     * registered scopes (MCP clients like Claude Code omit it).
     */
    scope?: string;
    /** CSRF protection token (passed back on redirect) */
    state?: string;
    /** PKCE code challenge (required for public clients) */
    codeChallenge?: string;
    /** PKCE method: 'S256' (recommended) or 'plain' */
    codeChallengeMethod?: string;
}
/**
 * Scope information for display in consent screen
 */
interface OAuthScopeInfo {
    /** The scope identifier (e.g., 'photographs:read') */
    scope: string;
    /** Human-readable scope name */
    name: string;
    /** Description of what this scope allows */
    description: string;
    /** Optional icon identifier */
    icon?: string;
}
/**
 * Client info returned for consent screen display
 */
interface OAuthConsentInfo {
    client: OAuthClientInterface;
    scopes: OAuthScopeInfo[];
}
/**
 * Default scope display configuration
 * Maps scope identifiers to human-readable info
 */
declare const OAUTH_SCOPE_DISPLAY: Record<string, OAuthScopeInfo>;
/**
 * Available scopes list for the scope selector
 */
declare const AVAILABLE_OAUTH_SCOPES: OAuthScopeInfo[];
/**
 * Default grant types for new clients
 */
declare const DEFAULT_GRANT_TYPES: string[];

export { AVAILABLE_OAUTH_SCOPES as A, DEFAULT_GRANT_TYPES as D, type OAuthClientInterface as O, type OAuthClientInput as a, type OAuthClientCreateRequest as b, type OAuthClientCreateResponse as c, type OAuthConsentRequest as d, type OAuthScopeInfo as e, type OAuthConsentInfo as f, OAUTH_SCOPE_DISPLAY as g };