import type { InputRequiredResult } from '@modelcontextprotocol/server';
import type { UpstreamAuthRequiredEvent } from './upstream-auth.js';
import type { SchemeChoice, UpstreamApiAuth, UpstreamAuthScheme } from './upstream-auth-scheme.js';
import type { KvService } from '@redocly/config';
export declare const CREDENTIALS_INPUT_REQUEST_KEY = "credentials";
export type CredentialTarget = {
    api: string;
    name: string;
    scheme: string;
    schemeLabel?: string;
};
/**
 * Why the prompt is being raised. `authFailure` is the automatic path behind an upstream 401;
 * `requested` is the model calling the credentials tool on the user's behalf.
 */
export type CredentialElicitationReason = {
    kind: 'authFailure';
    status: number;
    detail?: string;
    otherApiNames?: string[];
} | {
    kind: 'requested';
};
type CredentialElicitationRequest = {
    subject: string;
    baseUrl: string;
    target: CredentialTarget;
    auth: UpstreamAuthScheme;
    apiAuth?: UpstreamApiAuth;
    kv: KvService;
    hasExistingSecret: boolean;
    reason: CredentialElicitationReason;
};
/** Concurrent prompts for one subject and scheme share the link the first one mints. */
export declare function dedupeElicitation(key: string, run: () => Promise<string>): Promise<string>;
export declare function supportsUrlElicitation(capabilities: {
    elicitation?: {
        url?: unknown;
    };
} | undefined): boolean;
/** Only a 2026-07-28-era request carries `_meta` envelope keys, and it needs no session. */
export declare function isStatelessRequest(mcpReq: {
    envelope?: unknown;
}): boolean;
export declare function isCredentialElicitationDeclined(inputResponses: Record<string, unknown> | undefined): boolean;
export declare function schemeLabelOf(schemes: Record<string, unknown>, scheme: string): string | undefined;
/**
 * The 2026-07-28-era credentials prompt: the tool call returns an input-required result the
 * client fulfils and retries, with no push `elicitation/create` and no session behind it.
 * Nothing has to survive the round trip - the secrets are keyed by `subject`, which is
 * recomputed from the caller's identity on every request.
 */
export declare function buildUpstreamCredentialInputRequired(request: CredentialElicitationRequest): Promise<InputRequiredResult>;
/** Fallback text for a client without URL-elicitation support. */
export declare function buildUpstreamCredentialFallback(request: CredentialElicitationRequest): Promise<string>;
/**
 * Text for an authorization failure we deliberately do NOT prompt for: a stored secret the
 * upstream rejected, a 401 that never carried a stored credential, or a 403/407 that is more
 * likely a permissions problem than a missing key.
 */
export declare function buildCredentialsToolHint(event: UpstreamAuthRequiredEvent, schemeLabel?: string): string;
/**
 * Text for an operation that accepts several security schemes and has no stored credential for
 * any of them. Picking one here is what sent an API key as a session cookie, so the model is told
 * to ask the user which credential they hold and pass it back as `scheme`.
 */
export declare function buildSchemeChoiceHint(event: UpstreamAuthRequiredEvent, choices: readonly SchemeChoice[]): string;
export {};
//# sourceMappingURL=elicitation.d.ts.map