/**
 * OAuth Hook Manager
 *
 * Manages loading and calling lifecycle hooks for the OAuth plugin
 */
import type { OAuthHooks, OAuthUser, OnLoginResult, TokenResponse, Logger, OAuthProviderConfig } from '../types.ts';
/**
 * Hook Manager
 * Loads and executes OAuth lifecycle hooks
 */
export declare class HookManager {
    private hooks;
    private logger?;
    constructor(logger?: Logger);
    /**
     * Register hooks programmatically
     * Allows applications to register hooks directly without using config
     */
    register(hooks: OAuthHooks): void;
    /**
     * Call onLogin hook
     *
     * Returns the hook's result verbatim — including a structured outcome
     * (`{ status: 'denied' | 'needs_confirmation', ... }`, #174) that the
     * callback handler interprets. A thrown error is caught and logged and
     * behaves like no return value (login proceeds): deliberate gating is
     * expressed via the return value, not by throwing.
     */
    callOnLogin(oauthUser: OAuthUser, tokenResponse: TokenResponse, session: any, request: any, provider: string): Promise<OnLoginResult | void>;
    /**
     * Call onLogout hook
     */
    callOnLogout(session: any, request: any): Promise<void>;
    /**
     * Call onMCPTokenIssued hook (fire-and-forget).
     *
     * NOT awaited: the hook runs detached after the token is durably issued, so it
     * can never add latency to — or block — token issuance (per @kriszyp's review
     * on #141; this also removes the need for a hook-execution timeout, #143). A
     * rejection, or a synchronous throw, from app code is caught and logged here,
     * never surfaced to the caller.
     */
    callOnMCPTokenIssued(event: {
        type: 'access' | 'refresh' | 'client_credentials';
        client_id: string;
        sub: string;
        aud: string;
        scope?: string;
        jti: string;
    }, request: any): void;
    /**
     * Call onTokenRefresh hook
     */
    callOnTokenRefresh(session: any, refreshed: boolean, request?: any): Promise<void>;
    /**
     * Check if a specific hook is registered
     */
    hasHook(hookName: keyof OAuthHooks): boolean;
    /**
     * Check if any hooks are loaded
     */
    hasHooks(): boolean;
    /**
     * Call onResolveProvider hook
     *
     * Called when a provider is not found in the static registry.
     * Allows applications to dynamically resolve provider configurations.
     *
     * @param providerName - Provider name from URL path (e.g., "okta-org_abc123")
     * @param logger - Optional logger instance
     * @returns Provider configuration or null if not found
     * @throws Error if resolution fails
     */
    callResolveProvider(providerName: string, logger?: Logger): Promise<OAuthProviderConfig | null>;
}