/**
 * Generic OAuth flow for MCP servers.
 *
 * Allows users to authenticate with any OAuth-compatible MCP server
 * by providing authorization URL, token URL, and client credentials.
 */
import { OAuthCallbackFlow } from "@gajae-code/ai/utils/oauth/callback-server";
import type { OAuthController, OAuthCredentials } from "@gajae-code/ai/utils/oauth/types";
/**
 * Canonical MCP server resource URI per RFC 8707 §2: absolute URI, lowercase
 * scheme/host, no fragment, no trailing slash on an empty path.
 */
export declare function canonicalMCPResourceUri(raw: string): string | undefined;
export interface MCPOAuthConfig {
    /** Authorization endpoint URL */
    authorizationUrl: string;
    /** Token endpoint URL */
    tokenUrl: string;
    /**
     * Client ID (optional when already embedded in authorization URL). An
     * HTTPS URL here is a Client ID Metadata Document (CIMD) reference per
     * MCP 2026-07-28 and is used as-is; Dynamic Client Registration is only a
     * deprecated backwards-compatibility fallback when no client id exists.
     */
    clientId?: string;
    /** Client secret (optional for PKCE flows) */
    clientSecret?: string;
    /** OAuth scopes (space-separated) */
    scopes?: string;
    /** Exact redirect URI to advertise to the provider */
    redirectUri?: string;
    /** Custom callback port (default: 3000) */
    callbackPort?: number;
    /** Custom callback path (default: /callback or redirectUri pathname) */
    callbackPath?: string;
    /**
     * Canonical URI of the target MCP server (RFC 8707). Sent as the `resource`
     * parameter on BOTH the authorization and token requests, regardless of
     * authorization-server support.
     */
    resource?: string;
    /**
     * Expected authorization-server issuer recorded from validated discovery
     * metadata (RFC 9207 / MCP 2026-07-28). Validation fails closed on mismatch.
     */
    issuer?: string;
    /** `authorization_response_iss_parameter_supported` from the same metadata. */
    issuerResponseIssSupported?: boolean;
}
/**
 * Generic OAuth flow for MCP servers.
 * Supports standard OAuth 2.0 authorization code flow with PKCE.
 */
export declare class MCPOAuthFlow extends OAuthCallbackFlow {
    #private;
    private config;
    constructor(config: MCPOAuthConfig, ctrl: OAuthController);
    /**
     * Client id used during the authorization request. Returns the value supplied
     * via {@link MCPOAuthConfig.clientId} or, when the server required dynamic
     * client registration, the id issued during registration. `undefined` until
     * {@link generateAuthUrl} (or {@link login}) has run for a server that needs
     * a client id.
     */
    get resolvedClientId(): string | undefined;
    /**
     * Client secret issued by dynamic client registration, if any. Always
     * `undefined` for PKCE-only/public clients and when the caller supplies the
     * client id via config.
     */
    get registeredClientSecret(): string | undefined;
    generateAuthUrl(state: string, redirectUri: string): Promise<{
        url: string;
        instructions?: string;
    }>;
    exchangeToken(code: string, _state: string, redirectUri: string): Promise<OAuthCredentials>;
}