/**
 * MCP Callback Branch
 *
 * Invoked from the main `handleCallback` (handlers.ts) when the verified
 * CSRF state carries an `mcp` payload — i.e., the flow was kicked off by
 * /oauth/mcp/authorize, not /oauth/<provider>/login. We've already
 * completed the upstream OAuth dance and run the `onLogin` hook; this
 * function mints the MCP authorization code and redirects the user-agent
 * back to the MCP client's `redirect_uri`.
 *
 * Importantly: this branch does NOT create a Harper session. MCP and
 * human-session lifecycles are kept independent in v1 (matches the
 * "independent lifecycle" resolved decision in #86). Future stages may
 * add an opt-in for joint sessions.
 *
 * Never include the upstream IdP token in the response to the MCP client
 * — that's the spec-mandated "no token passthrough" rule.
 */
import type { Logger, MCPAuthorizeState, MCPConfig, Request } from '../../types.ts';
type Redirect = {
    status: 302;
    headers: {
        Location: string;
    };
};
/**
 * Mint an MCP authorization code and redirect to the MCP client.
 *
 * `userIdentifier` is the resolved Harper identity — the caller passes
 * `hookData?.user ?? oauthUser.username`, so any onLogin mapping that the
 * human-session branch would apply is also reflected on the auth code
 * (and downstream JWT in Stage 4).
 *
 * `mcpConfig` is used to resolve the issuer (RFC 9207 `iss` on the redirect).
 */
export declare function handleMCPCallback(request: Request, mcpState: MCPAuthorizeState, userIdentifier: string, mcpConfig: MCPConfig, logger?: Logger): Promise<Redirect>;
export {};