/**
 * OAuth Resource
 *
 * Harper resource class for handling OAuth REST endpoints
 */
import { Resource } from 'harper';
import type { RequestTarget } from 'harper';
import type { Request, Logger, MCPConfig, ProviderRegistry, OAuthProviderConfig } from '../types.ts';
import type { HookManager } from './hookManager.ts';
import type { DynamicProviderCache } from './dynamicProviderCache.ts';
/**
 * Parsed route information from a request target
 */
export interface ParsedRoute {
    providerName: string;
    action: string;
    path: string;
}
/**
 * Adapt the plugin's internal `{ status, body }` response envelope to a shape
 * Harper's REST layer recognizes as an explicit HTTP response.
 *
 * Harper only honors `status`/`headers` when the returned object carries a
 * `headers` field; a bare `{ status, body }` (no headers) is otherwise
 * serialized *whole* as the response body with a default 200 — so the status is
 * lost and the `{ status, body }` envelope leaks into the payload (this broke
 * DCR registration, token errors, 403/404 responses, etc.). Normalize those
 * envelopes to a Harper response with a `headers` field and a pre-serialized
 * JSON `body` (mirroring this plugin's well-known `jsonResponse` helper, which
 * works for the same reason). Serializing explicitly — rather than handing
 * Harper a `data` object to content-negotiate — guarantees JSON for these
 * OAuth/DCR API responses regardless of the client's `Accept` header.
 *
 * Already-valid responses are passed through untouched:
 *   - plain bodies with no `status` (Harper serializes them with a 200), and
 *   - header-bearing responses with no `body` (e.g. 3xx redirects with Location).
 */
export declare function toHttpResponse(result: any): any;
/**
 * OAuth Resource - proper Harper Resource class for handling OAuth endpoints
 * Follows Resource API v2 pattern (loadAsInstance = false)
 */
export declare class OAuthResource extends Resource {
    static loadAsInstance: boolean;
    static providers: ProviderRegistry;
    static debugMode: boolean;
    static hookManager: HookManager | null;
    static pluginDefaults: Partial<OAuthProviderConfig>;
    static dynamicProviderCache: DynamicProviderCache | null;
    static logger: Logger | undefined;
    static mcpConfig: MCPConfig | undefined;
    /**
     * Configure the OAuth resource with providers and settings
     * Called once during plugin initialization
     */
    static configure(providers: ProviderRegistry, debugMode: boolean, hookManager: HookManager, pluginDefaults: Partial<OAuthProviderConfig>, logger?: Logger, dynamicProviderCache?: DynamicProviderCache, mcpConfig?: MCPConfig): void;
    /**
     * Parse a request target into provider and action components
     * Exported as static method for testability
     */
    static parseRoute(target: RequestTarget): ParsedRoute;
    /**
     * Check if a route should return 404 in production mode
     * Debug-only endpoints return 404 when debug mode is off
     */
    static isDebugOnlyRoute(route: ParsedRoute): boolean;
    /**
     * Check if a request is allowed to access debug endpoints
     * Uses IP allowlist for security (defaults to localhost only)
     *
     * @param request - The incoming request
     * @param logger - Optional logger for access tracking
     * @returns true if access is allowed, false otherwise
     */
    static checkDebugAccess(request: Request, logger?: Logger): boolean;
    /**
     * Build forbidden response for unauthorized debug access
     */
    static forbiddenResponse(): any;
    /**
     * Build the standard 404 response
     */
    static notFoundResponse(): {
        status: number;
        body: {
            error: string;
        };
    };
    /**
     * Build provider list response for root path
     */
    static buildProviderListResponse(providers: ProviderRegistry): any;
    /**
     * Build provider info response
     */
    static buildProviderInfoResponse(providerName: string, providers: ProviderRegistry): any;
    /**
     * Build token status response for /refresh endpoint
     */
    static buildTokenStatusResponse(request: Request): any;
    /**
     * Handle GET requests to OAuth endpoints
     * Resource API v2 signature: get(target)
     *
     * Thin wrapper: routes to the implementation, then normalizes the internal
     * `{ status, body }` envelope into a Harper-recognized HTTP response (see
     * `toHttpResponse`).
     */
    get(target: RequestTarget): Promise<any>;
    handleGet(target: RequestTarget): Promise<any>;
    /**
     * Handle POST requests to OAuth endpoints
     * Resource API v2 signature: post(target, data)
     *
     * Thin wrapper: routes to the implementation, then normalizes the internal
     * `{ status, body }` envelope into a Harper-recognized HTTP response (see
     * `toHttpResponse`).
     */
    post(target: RequestTarget, data: any): Promise<any>;
    handlePost(target: RequestTarget, data: any): Promise<any>;
    /**
     * Expose hookManager for programmatic hook registration
     * This allows access via: scope.resources.get('oauth').hookManager
     */
    static getHookManager(): HookManager | null;
    /**
     * Expose providers for use with withOAuthValidation
     * This allows access via: scope.resources.get('oauth').providers
     */
    static getProviders(): ProviderRegistry;
    /**
     * Reset configuration (useful for testing)
     */
    static reset(): void;
}