/**
 * EVO-12 hosted OAuth — single-tenant authorization server (ported from
 * mcp-wave). Implements the MCP SDK OAuthServerProvider surface: DCR client
 * registration (redirect-uri allowlisted), operator-consent authorize,
 * auth-code + PKCE exchange, refresh, access-token verify/revoke. Scope is
 * read-only `h2a:read`. The OAuth tokens grant access to the read-only MCP tool
 * surface only — never to any signing tool / private key (DEC-116). The
 * client never receives an h2a private key.
 */
import type { OAuthRegisteredClientsStore } from "@modelcontextprotocol/sdk/server/auth/clients.js";
import type { AuthorizationParams } from "@modelcontextprotocol/sdk/server/auth/provider.js";
import type { AuthInfo } from "@modelcontextprotocol/sdk/server/auth/types.js";
import type { OAuthClientInformationFull, OAuthTokenRevocationRequest, OAuthTokens } from "@modelcontextprotocol/sdk/shared/auth.js";
import type { FileOAuthStore } from "./file-store.js";
export type AuthorizeOutcome = {
    kind: "consent";
    status: 200 | 401;
    html: string;
} | {
    kind: "redirect";
    location: string;
};
interface ProviderOptions {
    store: FileOAuthStore;
    nodeEnv: string;
    issuerUrl: URL;
    publicBaseUrl: URL;
    resourceServerUrl: URL;
    consentSecret: string;
    allowedRedirectUris: readonly string[];
    authCodeTtlSeconds: number;
    accessTokenTtlSeconds: number;
    refreshTokenTtlSeconds: number;
    nowSeconds?: () => number;
}
interface IssueCodeParams {
    redirectUri: string;
    codeChallenge: string;
    scopes: string[];
    resource?: URL;
    state?: string;
    /** EVO-12 P2 (mode 3): the 39-auth subject this code is minted for (broker flow). */
    sub?: string;
}
type WideClientsStore = Omit<OAuthRegisteredClientsStore, "registerClient"> & {
    registerClient?(client: OAuthClientInformationFull): OAuthClientInformationFull | Promise<OAuthClientInformationFull>;
};
export declare class SingleTenantOAuthProvider {
    private readonly opts;
    readonly clientsStore: WideClientsStore;
    constructor(opts: ProviderOptions);
    private nowSeconds;
    authorizeRequest(client: OAuthClientInformationFull, params: AuthorizationParams, input: {
        method: string;
        consentSecret?: string;
    }): Promise<AuthorizeOutcome>;
    issueAuthorizationCode(client: OAuthClientInformationFull, params: IssueCodeParams): Promise<string>;
    private renderConsentForm;
    challengeForAuthorizationCode(_client: OAuthClientInformationFull, authorizationCode: string): Promise<string>;
    exchangeAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string, _codeVerifier?: string, redirectUri?: string, resource?: URL): Promise<OAuthTokens>;
    exchangeRefreshToken(client: OAuthClientInformationFull, refreshToken: string, scopes?: string[], resource?: URL): Promise<OAuthTokens>;
    verifyAccessToken(token: string): Promise<AuthInfo>;
    revokeToken(_client: OAuthClientInformationFull, request: OAuthTokenRevocationRequest): Promise<void>;
    issueTokensForTests(client: OAuthClientInformationFull): Promise<OAuthTokens>;
    private issueTokens;
    private normalizeScopes;
    private normalizeResource;
}
export {};
//# sourceMappingURL=single-tenant-provider.d.ts.map