/**
 * Authorization Required Error
 *
 * Thrown when a tool requires app-level authorization that the user has not granted.
 * Used for progressive/incremental authorization flow where users can skip apps
 * during initial auth and authorize later when needed.
 *
 * Behavior depends on session mode:
 * - Stateful: Returns auth_url link for incremental authorization
 * - Stateless: Returns unauthorized error (no link, must re-auth from scratch)
 *
 * Supports MCP elicit flow for clients that support it.
 */
import { z } from '@frontmcp/lazy-zod';
import { PublicMcpError } from './mcp.error';
/**
 * Session mode determines how authorization state is stored
 */
export type SessionMode = 'stateful' | 'stateless';
/**
 * Elicit response type for clients that support elicit flow
 */
export declare const elicitResponseSchema: import("@frontmcp/lazy-zod").ZodObject<{
    elicitId: import("@frontmcp/lazy-zod").ZodString;
    authUrl: import("@frontmcp/lazy-zod").ZodString;
    message: import("@frontmcp/lazy-zod").ZodString;
    appId: import("@frontmcp/lazy-zod").ZodString;
    toolId: import("@frontmcp/lazy-zod").ZodString;
}, import("zod/v4/core").$strip>;
export type ElicitResponse = z.infer<typeof elicitResponseSchema>;
/**
 * Schema for authorization required response data (stateful mode with link)
 */
export declare const authorizationRequiredDataSchema: import("@frontmcp/lazy-zod").ZodObject<{
    error: import("@frontmcp/lazy-zod").ZodLiteral<"authorization_required">;
    app: import("@frontmcp/lazy-zod").ZodString;
    tool: import("@frontmcp/lazy-zod").ZodString;
    auth_url: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    message: import("@frontmcp/lazy-zod").ZodString;
    required_scopes: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
    session_mode: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
        stateful: "stateful";
        stateless: "stateless";
    }>>;
    elicit_id: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    supports_incremental: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
}, import("zod/v4/core").$strip>;
/**
 * Schema for authorization required error constructor params
 */
export declare const authorizationRequiredParamsSchema: import("@frontmcp/lazy-zod").ZodObject<{
    appId: import("@frontmcp/lazy-zod").ZodString;
    toolId: import("@frontmcp/lazy-zod").ZodString;
    authUrl: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    requiredScopes: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
    message: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    sessionMode: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
        stateful: "stateful";
        stateless: "stateless";
    }>>;
    elicitId: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    vaultId: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    pendingAuthId: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
}, import("zod/v4/core").$strip>;
/**
 * Schema for the _meta field in MCP error response
 */
export declare const authorizationRequiredMetaSchema: import("@frontmcp/lazy-zod").ZodObject<{
    errorId: import("@frontmcp/lazy-zod").ZodString;
    code: import("@frontmcp/lazy-zod").ZodString;
    timestamp: import("@frontmcp/lazy-zod").ZodString;
    authorization_required: import("@frontmcp/lazy-zod").ZodLiteral<true>;
    app: import("@frontmcp/lazy-zod").ZodString;
    tool: import("@frontmcp/lazy-zod").ZodString;
    auth_url: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    required_scopes: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
    session_mode: import("@frontmcp/lazy-zod").ZodEnum<{
        stateful: "stateful";
        stateless: "stateless";
    }>;
    supports_incremental: import("@frontmcp/lazy-zod").ZodBoolean;
    elicit_id: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    pending_auth_id: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
}, import("zod/v4/core").$strip>;
/**
 * Data structure for authorization required responses
 */
export type AuthorizationRequiredData = z.infer<typeof authorizationRequiredDataSchema>;
/**
 * Constructor params for AuthorizationRequiredError
 */
export type AuthorizationRequiredParams = z.infer<typeof authorizationRequiredParamsSchema>;
/**
 * Meta field type for MCP error response
 */
export type AuthorizationRequiredMeta = z.infer<typeof authorizationRequiredMetaSchema>;
/**
 * Error thrown when a tool's parent app requires authorization.
 * This enables progressive authorization where users can authorize apps
 * incrementally as needed rather than all at once.
 *
 * Behavior depends on session mode:
 * - **Stateful**: Returns auth_url link for incremental authorization
 *   - User can click link to authorize without full re-authentication
 *   - Supports elicit flow for interactive authorization
 * - **Stateless**: Returns unauthorized error only
 *   - No link provided (all state in JWT, cannot extend)
 *   - User must re-authenticate from scratch
 *
 * @example
 * ```typescript
 * // Stateful mode - can provide auth link
 * throw new AuthorizationRequiredError({
 *   appId: 'slack',
 *   toolId: 'slack:send_message',
 *   authUrl: '/oauth/authorize?app=slack',
 *   sessionMode: 'stateful',
 *   message: 'Please authorize Slack to use this tool.',
 * });
 *
 * // Stateless mode - no link, must re-auth
 * throw new AuthorizationRequiredError({
 *   appId: 'slack',
 *   toolId: 'slack:send_message',
 *   sessionMode: 'stateless',
 *   message: 'You are not authorized to use this tool.',
 * });
 * ```
 */
export declare class AuthorizationRequiredError extends PublicMcpError {
    /** App ID that requires authorization */
    readonly appId: string;
    /** Tool ID that triggered the authorization requirement */
    readonly toolId: string;
    /** URL to authorize the app (only available in stateful mode) */
    readonly authUrl?: string;
    /** Scopes required by the tool (optional) */
    readonly requiredScopes?: string[];
    /** Session mode determines if incremental auth is supported */
    readonly sessionMode: SessionMode;
    /** Elicit ID if using elicit flow */
    readonly elicitId?: string;
    /** Vault ID for stateful sessions */
    readonly vaultId?: string;
    /** Pending auth ID for tracking */
    readonly pendingAuthId?: string;
    /** Whether incremental authorization is supported */
    readonly supportsIncremental: boolean;
    constructor(params: AuthorizationRequiredParams);
    /**
     * Convert to MCP error response format with authorization metadata.
     * The _meta field includes structured data that AI agents can use
     * to prompt users for authorization.
     *
     * In stateful mode: includes auth_url for AI to display
     * In stateless mode: no auth_url, AI should inform user to re-authenticate
     */
    toMcpError(isDevelopment?: boolean): {
        content: Array<{
            type: 'text';
            text: string;
        }>;
        isError: true;
        _meta: AuthorizationRequiredMeta;
    };
    /**
     * Convert to structured authorization required data
     */
    toAuthorizationRequiredData(): AuthorizationRequiredData;
    /**
     * Create an elicit response for clients that support it
     * Only available in stateful mode
     */
    toElicitResponse(): ElicitResponse | null;
    /**
     * Check if this error can be resolved via incremental auth link
     */
    canUseIncrementalAuth(): boolean;
    /**
     * Get user-facing message based on mode
     * - Stateful: includes link text
     * - Stateless: tells user to re-authenticate
     */
    getUserFacingMessage(): string;
    /**
     * Get message for cancelled authorization
     */
    static getCancelledMessage(appId: string, toolId: string, authUrl?: string): string;
}
//# sourceMappingURL=authorization-required.error.d.ts.map