/**
 * MCP Token Endpoint (POST /oauth/mcp/token)
 *
 * Exchanges an authorization code (PKCE-verified) or a refresh token for an
 * audience-bound RS256 JWT access token. Mirrors DCR's JSON request/response
 * shape (`{ status, body }` with OAuth 2.0 error objects).
 *
 * Access tokens are stateless (no token-table round trip); refresh tokens use
 * single-use family rotation (see refreshTokenStore.ts). The upstream IdP token
 * never appears in claims or the response.
 */
import type { HookManager } from '../hookManager.ts';
import type { Logger, MCPConfig, Request } from '../../types.ts';
type TokenResponse = {
    status: number;
    body: Record<string, unknown>;
    headers?: Record<string, string>;
};
/** Drop grant-limiter state (for testing). @internal */
export declare function _resetGrantRateLimiter(): void;
/**
 * Handle POST /oauth/mcp/token. Returns `{ status, body }`; the `enabled` gate
 * is applied upstream in handleMCPPost.
 *
 * `hookManager` is optional so callers that don't have access to it (e.g.
 * unit tests that go directly to this function) can omit it without error.
 * When present, `onMCPTokenIssued` is fired after every successful mint.
 */
export declare function handleToken(request: Request | undefined, body: any, mcpConfig: MCPConfig, hookManager?: HookManager, logger?: Logger): Promise<TokenResponse>;
export {};