import type { OAuthController, OAuthCredentials } from "./types";
export type CallbackResult = {
    code: string;
    state: string;
};
export interface OAuthCallbackFlowOptions {
    preferredPort: number;
    callbackPath?: string;
    callbackHostname?: string;
    /** Local listener hostname; defaults to callbackHostname when omitted. */
    callbackBindHostname?: string;
    /** Exact redirect URI advertised to the provider; disables port fallback. */
    redirectUri?: string;
    /**
     * Do not bind a local listener at all. The provider redirects somewhere this
     * process cannot observe (a hosted "copy this code" page, a custom protocol),
     * so the code arrives by paste instead. Requires both `redirectUri` and an
     * `onManualCodeInput` handler on the controller.
     */
    skipCallbackServer?: boolean;
    /**
     * Expected authorization-server issuer recorded from validated metadata
     * (RFC 9207 / MCP 2026-07-28). When set, a present `iss` that differs
     * rejects the response before any other parameter is acted on.
     */
    expectedIssuer?: string;
    /**
     * `authorization_response_iss_parameter_supported` from the same metadata.
     * When true, a response WITHOUT `iss` is rejected.
     */
    issuerResponseIssSupported?: boolean;
}
/**
 * Abstract base class for OAuth flows with local callback servers.
 */
export declare abstract class OAuthCallbackFlow {
    #private;
    ctrl: OAuthController;
    preferredPort: number;
    callbackPath: string;
    callbackHostname: string;
    callbackBindHostname: string;
    redirectUri?: string;
    expectedIssuer?: string;
    issuerResponseIssSupported?: boolean;
    constructor(ctrl: OAuthController, preferredPortOrOptions: number | OAuthCallbackFlowOptions, callbackPath?: string);
    /**
     * Generate provider-specific authorization URL.
     * @param state - CSRF state token
     * @param redirectUri - The actual redirect URI to use (may differ from expected if port fallback occurred)
     * @returns Authorization URL and optional instructions
     */
    abstract generateAuthUrl(state: string, redirectUri: string): Promise<{
        url: string;
        instructions?: string;
    }>;
    /**
     * Exchange authorization code for OAuth tokens.
     * @param code - Authorization code from callback
     * @param state - CSRF state token
     * @param redirectUri - The actual redirect URI used (must match authorization request)
     * @returns OAuth credentials
     */
    abstract exchangeToken(code: string, state: string, redirectUri: string): Promise<OAuthCredentials>;
    /**
     * Generate CSRF state token. Override if provider needs custom state generation.
     */
    generateState(): string;
    /**
     * Execute the OAuth login flow.
     */
    login(): Promise<OAuthCredentials>;
}
/**
 * Parse a redirect URL or code string to extract code and state.
 */
export declare function parseCallbackInput(input: string): {
    code?: string;
    state?: string;
};