/**
 * OAuth 2.1 Provider logic for TypeScript MCP servers.
 *
 * Implements the "MCP Server as Authorization Server" pattern.
 * The MCP Server issues JWTs, processes PKCE verification,
 * and uses the Relay Server purely as a UI consent transport.
 */
import type { RelayConfigSchema } from '../schema/types.js';
import { type IOAuthSessionCache } from './cache.js';
import type { JWTIssuer } from './jwt-issuer.js';
export { InMemoryAuthCache, type IOAuthSessionCache, type PreAuthSession } from './cache.js';
export interface OAuthProviderOptions {
    serverName: string;
    relayBaseUrl: string;
    relaySchema: RelayConfigSchema;
    jwtIssuer: JWTIssuer;
    cache?: IOAuthSessionCache;
}
export declare class OAuthProvider {
    private serverName;
    private relayBaseUrl;
    private relaySchema;
    private jwtIssuer;
    private cache;
    constructor(options: OAuthProviderOptions);
    /**
     * Create a relay session and return the URL to redirect the user to.
     */
    createAuthorizeRedirect(clientId: string, redirectUri: string, state: string, codeChallenge: string, codeChallengeMethod?: string): Promise<string>;
    /**
     * Exchange the authorization code (relay session ID) for an access_token.
     * PKCE verification is performed.
     *
     * @param code The authorization code from the client.
     * @param codeVerifier The PKCE code verifier.
     * @param userIdExtractor Function to derive a unique user_id from the credentials.
     * @returns Tuple of [access_token, credentials]
     */
    exchangeCode(code: string, codeVerifier: string, userIdExtractor: (credentials: Record<string, string>) => string): Promise<{
        accessToken: string;
        credentials: Record<string, string>;
    }>;
    /**
     * Reconstruct relay session from pre-auth session.
     */
    private reconstructRelaySession;
    /**
     * Get RFC 8414 Authorization Server Metadata.
     */
    getMetadata(baseUrl: string): Record<string, unknown>;
}
//# sourceMappingURL=provider.d.ts.map