import { type Settings } from "@opengeni/config";
import { OAuthStartResponse, type ConnectionOwnership, type OAuthStartRequest } from "@opengeni/contracts";
import { ExternalActorContinuation } from "@opengeni/contracts/external-identities";
import type { Observability } from "@opengeni/observability";
import { type Database } from "@opengeni/db";
import { type McpAuthorizationServerMetadata } from "@opengeni/network";
import { type OAuthProviderProfile } from "./oauth-profiles.js";
export declare const oauthStateTtlMs: number;
export { OFFICIAL_GMAIL_MCP_SCOPES, OFFICIAL_GMAIL_MCP_URL, OFFICIAL_SLACK_MCP_URL, } from "./oauth-profiles.js";
export { OAUTH_MAX_RESPONSE_BYTES } from "@opengeni/network";
type OAuthClientDeps = {
    db: Database;
    settings: Settings;
    observability?: Observability | undefined;
    oauthStartDeadlineMs?: number | undefined;
    oauthCallbackDeadlineMs?: number | undefined;
};
export type OAuthStartContext = {
    connectAttemptId?: string;
    externalContinuation?: ExternalActorContinuation;
    accountId: string;
    workspaceId: string;
    subjectId: string;
    /**
     * False for every principal that cannot own a personal Connection (API keys,
     * the configured key, services, agent attempts). Resolved by the route from
     * the live authenticated principal, never inferred here.
     */
    personalOwnershipAllowed: boolean;
    requestUrl: string;
    payload: OAuthStartRequest;
};
export type OAuthCallbackResult = {
    redirectTo: string;
    exactReturn?: boolean;
};
type AuthorizationServerMetadata = McpAuthorizationServerMetadata;
export declare const OAUTH_START_DEADLINE_MS = 15000;
export declare const OAUTH_CALLBACK_DEADLINE_MS = 30000;
export type OAuthStartStage = "connection_lookup" | "mcp_challenge" | "protected_resource_metadata" | "authorization_server_metadata" | "client_registration";
export declare function startMcpOAuth(deps: OAuthClientDeps, context: OAuthStartContext): Promise<OAuthStartResponse>;
/** Ownership fence for the official Gmail profile, keyed by exact MCP URL. */
export declare function assertOfficialGmailPersonalOwnership(mcpUrl: string, ownership: ConnectionOwnership): void;
/**
 * Slack's hosted MCP issues user tokens only. Sharing one human's grant as
 * workspace authority made every shared agent act as a named employee; the
 * OpenGeni workspace bot owns shared Slack access instead (bot-token search
 * covers public channels, files, and users).
 */
export declare function assertHostedSlackMcpPersonalOwnership(hostedSlackMcp: boolean, ownership: ConnectionOwnership): void;
export declare function isHostedSlackMcpTarget(providerDomain: string, mcpUrl: string): boolean;
export declare function completeMcpOAuthCallback(deps: OAuthClientDeps, input: {
    code?: string | undefined;
    state?: string | undefined;
    requestUrl: string;
}): Promise<OAuthCallbackResult>;
export declare function integrationBaseUrl(publicBaseUrl: string | undefined, requestUrl: string): string;
export declare function requireIntegrationsStateSecret(settings: Settings): string;
/** The hosted-Slack profile's origin pins, kept exported for its tests. */
export declare function assertSlackAuthorizationServer(as: AuthorizationServerMetadata): void;
/** The official-Gmail profile's origin pins, kept exported for its tests. */
export declare function assertGoogleAuthorizationServer(as: AuthorizationServerMetadata): void;
/** Inspect without credentials, registration, or running tools. */
export declare function inspectMcpAuthentication(resource: string, settings: Settings): Promise<{
    kind: "oauth2" | "none" | "unknown";
    message?: string;
}>;
export declare function preferredOAuthSelfRegistration(as: Pick<AuthorizationServerMetadata, "clientIdMetadataDocumentSupported" | "registrationEndpoint">, clientSource: OAuthProviderProfile["clientSource"]): "cimd" | "dcr" | null;
export declare function buildAuthorizationUrl(input: {
    endpoint: string;
    settings: Settings;
    clientId: string;
    redirectUri: string;
    state: string;
    resource: string;
    verifier: string;
    scopes: string[];
    resourceParameterSupported: boolean;
    /** Profile-declared extra authorize parameters, applied last. */
    extraParams?: Readonly<Record<string, string>> | undefined;
}): string;
export type OAuthPublicErrorFields = {
    errorClass: "OAuthOperationError";
    errorCode: "oauth_operation_failed";
    status?: number;
    origin: "oauth";
};
/** Allowlisted projection for public telemetry; canonical OAuth errors stay exact. */
export declare function oauthPublicErrorFields(error: unknown): OAuthPublicErrorFields;
export declare function chooseMcpAuthorizeScopes(input: {
    mcpUrl: string;
    requested: string[] | undefined;
    challenged: string[] | undefined;
    supported: string[];
}): string[];