import { Event } from "@codingame/monaco-vscode-api/vscode/vs/base/common/event";
import { Disposable } from "@codingame/monaco-vscode-api/vscode/vs/base/common/lifecycle";
import { IProductService } from "@codingame/monaco-vscode-api/vscode/vs/platform/product/common/productService.service";
import { IStorageService } from "@codingame/monaco-vscode-api/vscode/vs/platform/storage/common/storage.service";
import { IAuthenticationMcpAccessService } from "@codingame/monaco-vscode-api/vscode/vs/workbench/services/authentication/browser/authenticationMcpAccessService.service";
/**
 * Compares two MCP server URLs for the purpose of access binding. They are compared by their canonical
 * WHATWG URL form, so cosmetic differences in the origin (host case, default port, encoding) and a root
 * trailing slash ("foo.com" vs "foo.com/") don't force a spurious re-consent — while a trailing slash on
 * a path ("foo.com/a" vs "foo.com/a/") is preserved as a meaningful difference between endpoints.
 */
export declare function urlsEqual(a: string | undefined, b: string | undefined): boolean;
export interface AllowedMcpServer {
    id: string;
    name: string;
    /**
     * If true or undefined, the extension is allowed to use the account
     * If false, the extension is not allowed to use the account
     * TODO: undefined shouldn't be a valid value, but it is for now
     */
    allowed?: boolean;
    lastUsed?: number;
    trusted?: boolean;
    /**
     * The MCP server URL the grant was made for. A token is only released to a server whose current
     * URL matches this, so changing the URL while keeping the same id requires the user to re-consent.
     * Undefined for stdio servers, which have no URL.
     */
    url?: string;
    /**
     * Set when the grant is for an MCP server hosted by an agent host (which runs the server in the
     * CLI/agent-host process rather than registering it with the workbench `IMcpService`). Carries the
     * host `authority` and its display `label` so management surfaces can present agent-host servers in
     * their own section instead of filtering them out as "unknown". Agent hosts
     * may be ephemeral and not always connected, but we still want to be able to
     * display grants we know about and will respect.
     */
    agentHost?: {
        authority: string;
        label: string;
    };
}
export declare class AuthenticationMcpAccessService extends Disposable implements IAuthenticationMcpAccessService {
    private readonly _storageService;
    private readonly _productService;
    _serviceBrand: undefined;
    private _onDidChangeMcpSessionAccess;
    readonly onDidChangeMcpSessionAccess: Event<{
        providerId: string;
        accountName: string;
    }>;
    constructor(_storageService: IStorageService, _productService: IProductService);
    isAccessAllowed(providerId: string, accountName: string, mcpServerId: string): boolean | undefined;
    isAccessAllowedForUrl(providerId: string, accountName: string, mcpServerId: string, mcpServerUrl: string): boolean | undefined;
    private _isAccessAllowed;
    readAllowedMcpServers(providerId: string, accountName: string): AllowedMcpServer[];
    updateAllowedMcpServers(providerId: string, accountName: string, mcpServers: AllowedMcpServer[]): void;
    removeAllowedMcpServers(providerId: string, accountName: string): void;
}