export type McpProxyMode = "stdio-proxy" | "direct-http" | "tool-native-oauth";
export type McpSecretStorage = "keychain" | "libsecret" | "windows-credential" | "secure-file";
export interface McpOAuthProxyConfig {
    enabled: boolean;
    mode: McpProxyMode;
    serverUrl: string;
    authorizationUrl?: string;
    tokenUrl?: string;
    registrationUrl?: string;
    clientId?: string;
    clientSecret?: string;
    clientName?: string;
    dynamicRegistration?: boolean;
    scopes?: string[];
    tokenStorage: McpSecretStorage;
    tokenPath?: string;
    refreshWindowSeconds: number;
    approvedBy?: string;
}
export interface McpProxyEvaluation {
    approved: boolean;
    risks: string[];
    recommendations: string[];
    modes: {
        mode: McpProxyMode;
        summary: string;
        tradeOff: string;
    }[];
}
export interface McpTokenState {
    accessToken: string;
    refreshToken: string;
    expiresAt: string;
}
export interface McpTokenRefreshResult {
    refreshed: boolean;
    reason: string;
    token: McpTokenState;
}
export interface McpTokenStatus {
    exists: boolean;
    expiresAt?: string;
    needsRefresh?: boolean;
}
export interface McpOAuthStartResult {
    mode: McpProxyMode;
    serverUrl: string;
    token: McpTokenStatus;
    proxyReady: boolean;
}
export type McpOAuthDiagnosticStage = "discovery" | "registration" | "authorization-start" | "authorization-callback" | "token-exchange" | "refresh" | "status";
export interface McpOAuthDiagnostic {
    stage: McpOAuthDiagnosticStage;
    state: "unavailable" | "revoked" | "expired" | "failed";
    message: string;
    retryable: boolean;
}
export interface McpOAuthAuthorizationServerMetadata {
    issuer?: string;
    authorizationEndpoint: string;
    tokenEndpoint: string;
    registrationEndpoint?: string;
    scopesSupported?: string[];
}
export interface McpOAuthDynamicClientRegistration {
    clientId: string;
    clientSecret?: string;
    clientIdIssuedAt?: number;
    clientSecretExpiresAt?: number;
}
export interface McpAuthenticatedRequest {
    method?: string;
    path: string;
    body?: string;
    headers?: Record<string, string>;
}
export interface McpAuthenticatedResponse {
    status: number;
    body: string;
    contentType?: string;
}
export declare function evaluateMcpOAuthProxy(config: McpOAuthProxyConfig): McpProxyEvaluation;
export declare function validateMcpOAuthProxyConfig(config: McpOAuthProxyConfig): string[];
export declare function diagnoseMcpOAuthFailure(stage: McpOAuthDiagnosticStage, error: unknown): McpOAuthDiagnostic;
export declare function discoverMcpOAuthMetadata({ serverUrl, fetchFn, }: {
    serverUrl: string;
    fetchFn?: typeof fetch;
}): Promise<McpOAuthAuthorizationServerMetadata>;
export declare function registerMcpOAuthClient({ metadata, clientName, redirectUris, scopes, fetchFn, }: {
    metadata: McpOAuthAuthorizationServerMetadata;
    clientName?: string;
    redirectUris: string[];
    scopes?: string[];
    fetchFn?: typeof fetch;
}): Promise<McpOAuthDynamicClientRegistration>;
export declare function resolveMcpOAuthDiscoveryConfig({ config, redirectUris, fetchFn, }: {
    config: McpOAuthProxyConfig;
    redirectUris: string[];
    fetchFn?: typeof fetch;
}): Promise<McpOAuthProxyConfig>;
export declare function readMcpTokenStatus(config: McpOAuthProxyConfig, now?: Date): Promise<McpTokenStatus>;
export declare function loadMcpToken(config: McpOAuthProxyConfig): Promise<McpTokenState>;
export declare function saveMcpToken(config: McpOAuthProxyConfig, token: McpTokenState): Promise<void>;
export declare function clearMcpToken(config: McpOAuthProxyConfig): Promise<{
    cleared: true;
}>;
export declare function forceRefreshMcpToken({ config, fetchFn, }: {
    config: McpOAuthProxyConfig;
    fetchFn?: typeof fetch;
}): Promise<McpTokenRefreshResult>;
export declare function startMcpOAuthProxy({ config, fetchFn, openBrowser, }: {
    config: McpOAuthProxyConfig;
    fetchFn?: typeof fetch;
    openBrowser?: boolean;
}): Promise<McpOAuthStartResult>;
export declare function proxyMcpHttpRequest({ config, request, fetchFn, }: {
    config: McpOAuthProxyConfig;
    request: McpAuthenticatedRequest;
    fetchFn?: typeof fetch;
}): Promise<McpAuthenticatedResponse>;
export declare function refreshMcpTokenIfNeeded({ token, now, refreshWindowSeconds, refresh, }: {
    token: McpTokenState;
    now?: Date;
    refreshWindowSeconds: number;
    refresh: (token: McpTokenState) => Promise<McpTokenState>;
}): Promise<McpTokenRefreshResult>;