import type { OAuthClientProvider, OAuthClientInformation, OAuthClientInformationFull, OAuthClientMetadata, OAuthTokens } from "@modelcontextprotocol/client";
import { McpOAuthStore } from "./oauth-store.js";
/**
 * Fixed loopback port for remote-MCP OAuth callbacks. It must stay STABLE across
 * logins: the redirect URI is baked into the dynamic client registration (RFC
 * 7591), so a changing port would invalidate the saved registration and force a
 * fresh one every time. Distinct from the provider-login port (1455).
 */
export declare const MCP_OAUTH_CALLBACK_PORT = 41999;
export declare const MCP_OAUTH_CALLBACK_PATH = "/oauth/callback";
/** The exact redirect URI registered with the authorization server. */
export declare function mcpOAuthRedirectUrl(): string;
/**
 * `OAuthClientProvider` for a single remote MCP server, backed by the on-disk
 * `McpOAuthStore`. The MCP SDK drives the whole RFC 6749/7591/8414 flow through
 * this object:
 *
 * - At connect time it reads `tokens()`; if absent/expired it tries a refresh,
 *   and if that fails it calls `redirectToAuthorization()` then throws
 *   `UnauthorizedError`.
 * - `redirectToAuthorization` is a NO-OP unless an `onRedirect` callback is
 *   supplied. Non-interactive paths (startup connect, add-probe) leave it unset,
 *   so a server needing auth fails cleanly (→ "requires login") without
 *   surprising the user with a browser tab. The interactive login path supplies
 *   `onRedirect` to open the browser.
 */
export declare class McpOAuthProvider implements OAuthClientProvider {
    private readonly store;
    private readonly serverName;
    private readonly onRedirect?;
    private readonly scope?;
    constructor(opts: {
        serverName: string;
        store?: McpOAuthStore;
        /** When set, the server is allowed to drive an interactive browser login. */
        onRedirect?: (url: URL) => void;
        scope?: string;
    });
    get redirectUrl(): string;
    get clientMetadata(): OAuthClientMetadata;
    state(): Promise<string>;
    clientInformation(): Promise<OAuthClientInformationFull | undefined>;
    saveClientInformation(info: OAuthClientInformation): Promise<void>;
    tokens(): Promise<OAuthTokens | undefined>;
    saveTokens(tokens: OAuthTokens): Promise<void>;
    redirectToAuthorization(authorizationUrl: URL): void;
    saveCodeVerifier(codeVerifier: string): Promise<void>;
    codeVerifier(): Promise<string>;
}
//# sourceMappingURL=oauth-provider.d.ts.map