/**
 * MCP Authorization Code Store
 *
 * Persists short-lived authorization codes in the `mcp_auth_codes` Harper
 * table. The table is declared with `@table(expiration: 300)`, so codes
 * auto-expire after 5 minutes — Stage 4's /token endpoint must still
 * delete on successful exchange (single-use), but the TTL is a safety
 * net against codes that are never redeemed.
 *
 * Explicit field access on encode/decode (no `{ ...raw }`) — Harper
 * tracked-object Proxies return empty own-keys, so spread would drop
 * scalar fields. See CLAUDE.md "GenericTrackedObject + spread" gotcha.
 */
import type { Logger, MCPAuthCodeRecord } from '../../types.ts';
/**
 * Reset the cached table reference (for testing only)
 * @internal
 */
export declare function resetMCPAuthCodesTableCache(): void;
export declare class MCPAuthCodeStore {
    private logger?;
    constructor(logger?: Logger);
    set(record: MCPAuthCodeRecord): Promise<void>;
    get(code: string): Promise<MCPAuthCodeRecord | null>;
    delete(code: string): Promise<void>;
    /**
     * Strict single-use consume for the /token exchange. Unlike `delete`, a
     * failure is NOT swallowed — the caller must refuse to issue a token if the
     * code could still be replayed. (A residual race remains: with a
     * get/put/delete-only table there is no atomic compare-and-delete, so two
     * concurrent exchanges of the same code could both pass before either
     * delete lands. Accepted given PKCE binding, the 5-minute TTL, and Harper's
     * single-trust-domain model.)
     */
    consume(code: string): Promise<void>;
}