import { Response } from "express";
import { OAuthServerProvider, AuthorizationParams } from "@modelcontextprotocol/sdk/server/auth/provider.js";
import { OAuthRegisteredClientsStore } from "@modelcontextprotocol/sdk/server/auth/clients.js";
import { OAuthClientInformationFull, OAuthTokens, OAuthTokenRevocationRequest } from "@modelcontextprotocol/sdk/shared/auth.js";
import { AuthInfo } from "@modelcontextprotocol/sdk/server/auth/types.js";
import { TokenStore } from "./token-store.js";
import { ElnoraConfig } from "../types.js";
export declare class ElnoraOAuthProvider implements OAuthServerProvider {
    private _clientsStore;
    private store;
    private config;
    constructor(config: ElnoraConfig, store: TokenStore, clientsStore: OAuthRegisteredClientsStore);
    /** Headers required by the platform's token validation endpoint */
    private get validationHeaders();
    get clientsStore(): OAuthRegisteredClientsStore;
    /**
     * Redirect the user to the Elnora platform login page.
     * After authentication, the platform redirects back to our callback,
     * which completes the OAuth flow back to the MCP client.
     */
    authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void>;
    challengeForAuthorizationCode(_client: OAuthClientInformationFull, authorizationCode: string): Promise<string>;
    exchangeAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string, _codeVerifier?: string, redirectUri?: string, resource?: URL): Promise<OAuthTokens>;
    exchangeRefreshToken(client: OAuthClientInformationFull, refreshToken: string, scopes?: string[], resource?: URL): Promise<OAuthTokens>;
    verifyAccessToken(token: string): Promise<AuthInfo>;
    /**
     * Retrieve the platform token for a validated MCP access token.
     * Used by index.ts to construct the API client — keeps platform tokens
     * out of AuthInfo.extra (CoSAI MCP-T1: no token passthrough).
     */
    getPlatformToken(accessToken: string): Promise<string | undefined>;
    revokeToken(client: OAuthClientInformationFull, request: OAuthTokenRevocationRequest): Promise<void>;
    /**
     * Handle the callback from the Elnora platform login and return the
     * client redirect URL atomically (single session lookup, no race window).
     * Verifies platformState to prevent CSRF / code substitution attacks.
     */
    handlePlatformCallback(mcpCode: string, platformCode: string, platformState: string): Promise<string>;
    /**
     * Attempt to refresh the platform token, update the stored record, and return AuthInfo.
     * If refresh fails or no refresh token exists, revokes all tokens and throws.
     */
    private attemptRefreshOrRevoke;
    /**
     * Attempt to refresh an expired platform token using the platform's refresh token.
     * Returns new tokens on success, or null if refresh fails (caller falls back to revocation).
     */
    private refreshPlatformToken;
    private issueTokens;
}
//# sourceMappingURL=provider.d.ts.map