import { z } from 'zod';
import { OneGrepApiClient, OneGrepApiHighLevelClient, Flags, FlagValue } from '@toolprint/sdk';
import { AuthenticationInfo } from '@propelauth/javascript';
import { TokenEndpointResponse, TokenEndpointResponseHelpers } from 'openid-client';
import { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';

declare const propelAuthSchema: z.ZodObject<{
    url: z.ZodString;
}, "strip", z.ZodTypeAny, {
    url?: string;
}, {
    url?: string;
}>;
declare const oidcSchema: z.ZodObject<{
    discoveryUrl: z.ZodString;
    clientId: z.ZodString;
    issuer: z.ZodOptional<z.ZodString>;
    redirectUrl: z.ZodOptional<z.ZodString>;
    jwtSecret: z.ZodOptional<z.ZodString>;
    jwtAudience: z.ZodDefault<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    discoveryUrl?: string;
    clientId?: string;
    issuer?: string;
    redirectUrl?: string;
    jwtSecret?: string;
    jwtAudience?: string;
}, {
    discoveryUrl?: string;
    clientId?: string;
    issuer?: string;
    redirectUrl?: string;
    jwtSecret?: string;
    jwtAudience?: string;
}>;
declare const posthogSchema: z.ZodObject<{
    apiKey: z.ZodString;
}, "strip", z.ZodTypeAny, {
    apiKey?: string;
}, {
    apiKey?: string;
}>;
declare const apiSchema: z.ZodObject<{
    url: z.ZodString;
}, "strip", z.ZodTypeAny, {
    url?: string;
}, {
    url?: string;
}>;
declare const demoSandboxSchema: z.ZodObject<{
    api: z.ZodObject<{
        url: z.ZodString;
    }, "strip", z.ZodTypeAny, {
        url?: string;
    }, {
        url?: string;
    }>;
    invitationCode: z.ZodString;
}, "strip", z.ZodTypeAny, {
    api?: {
        url?: string;
    };
    invitationCode?: string;
}, {
    api?: {
        url?: string;
    };
    invitationCode?: string;
}>;
declare const agentSchema: z.ZodObject<{
    agentType: z.ZodEnum<["blaxel", "local"]>;
    url: z.ZodEffects<z.ZodString, string, string>;
    apiKey: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    url?: string;
    apiKey?: string;
    agentType?: "blaxel" | "local";
}, {
    url?: string;
    apiKey?: string;
    agentType?: "blaxel" | "local";
}>;
declare const appSchema: z.ZodObject<{
    propelAuth: z.ZodObject<{
        url: z.ZodString;
    }, "strip", z.ZodTypeAny, {
        url?: string;
    }, {
        url?: string;
    }>;
    oidc: z.ZodObject<{
        discoveryUrl: z.ZodString;
        clientId: z.ZodString;
        issuer: z.ZodOptional<z.ZodString>;
        redirectUrl: z.ZodOptional<z.ZodString>;
        jwtSecret: z.ZodOptional<z.ZodString>;
        jwtAudience: z.ZodDefault<z.ZodString>;
    }, "strip", z.ZodTypeAny, {
        discoveryUrl?: string;
        clientId?: string;
        issuer?: string;
        redirectUrl?: string;
        jwtSecret?: string;
        jwtAudience?: string;
    }, {
        discoveryUrl?: string;
        clientId?: string;
        issuer?: string;
        redirectUrl?: string;
        jwtSecret?: string;
        jwtAudience?: string;
    }>;
    demoSandbox: z.ZodObject<{
        api: z.ZodObject<{
            url: z.ZodString;
        }, "strip", z.ZodTypeAny, {
            url?: string;
        }, {
            url?: string;
        }>;
        invitationCode: z.ZodString;
    }, "strip", z.ZodTypeAny, {
        api?: {
            url?: string;
        };
        invitationCode?: string;
    }, {
        api?: {
            url?: string;
        };
        invitationCode?: string;
    }>;
    agent: z.ZodObject<{
        agentType: z.ZodEnum<["blaxel", "local"]>;
        url: z.ZodEffects<z.ZodString, string, string>;
        apiKey: z.ZodOptional<z.ZodString>;
    }, "strip", z.ZodTypeAny, {
        url?: string;
        apiKey?: string;
        agentType?: "blaxel" | "local";
    }, {
        url?: string;
        apiKey?: string;
        agentType?: "blaxel" | "local";
    }>;
    posthog: z.ZodOptional<z.ZodObject<{
        apiKey: z.ZodString;
    }, "strip", z.ZodTypeAny, {
        apiKey?: string;
    }, {
        apiKey?: string;
    }>>;
}, "strip", z.ZodTypeAny, {
    propelAuth?: {
        url?: string;
    };
    oidc?: {
        discoveryUrl?: string;
        clientId?: string;
        issuer?: string;
        redirectUrl?: string;
        jwtSecret?: string;
        jwtAudience?: string;
    };
    demoSandbox?: {
        api?: {
            url?: string;
        };
        invitationCode?: string;
    };
    agent?: {
        url?: string;
        apiKey?: string;
        agentType?: "blaxel" | "local";
    };
    posthog?: {
        apiKey?: string;
    };
}, {
    propelAuth?: {
        url?: string;
    };
    oidc?: {
        discoveryUrl?: string;
        clientId?: string;
        issuer?: string;
        redirectUrl?: string;
        jwtSecret?: string;
        jwtAudience?: string;
    };
    demoSandbox?: {
        api?: {
            url?: string;
        };
        invitationCode?: string;
    };
    agent?: {
        url?: string;
        apiKey?: string;
        agentType?: "blaxel" | "local";
    };
    posthog?: {
        apiKey?: string;
    };
}>;
declare const userPreferencesSchema: z.ZodObject<{
    loginMode: z.ZodDefault<z.ZodEnum<["callback", "mcp-gateway"]>>;
    autoRefreshCredentials: z.ZodDefault<z.ZodBoolean>;
}, "strip", z.ZodTypeAny, {
    loginMode?: "callback" | "mcp-gateway";
    autoRefreshCredentials?: boolean;
}, {
    loginMode?: "callback" | "mcp-gateway";
    autoRefreshCredentials?: boolean;
}>;
declare const userSchema: z.ZodObject<{
    id: z.ZodString;
    email: z.ZodString;
    preferences: z.ZodDefault<z.ZodObject<{
        loginMode: z.ZodDefault<z.ZodEnum<["callback", "mcp-gateway"]>>;
        autoRefreshCredentials: z.ZodDefault<z.ZodBoolean>;
    }, "strip", z.ZodTypeAny, {
        loginMode?: "callback" | "mcp-gateway";
        autoRefreshCredentials?: boolean;
    }, {
        loginMode?: "callback" | "mcp-gateway";
        autoRefreshCredentials?: boolean;
    }>>;
}, "strip", z.ZodTypeAny, {
    id?: string;
    email?: string;
    preferences?: {
        loginMode?: "callback" | "mcp-gateway";
        autoRefreshCredentials?: boolean;
    };
}, {
    id?: string;
    email?: string;
    preferences?: {
        loginMode?: "callback" | "mcp-gateway";
        autoRefreshCredentials?: boolean;
    };
}>;
declare const orgSchema: z.ZodObject<{
    id: z.ZodString;
}, "strip", z.ZodTypeAny, {
    id?: string;
}, {
    id?: string;
}>;
declare const identitySchema: z.ZodObject<{
    user: z.ZodObject<{
        id: z.ZodString;
        email: z.ZodString;
        preferences: z.ZodDefault<z.ZodObject<{
            loginMode: z.ZodDefault<z.ZodEnum<["callback", "mcp-gateway"]>>;
            autoRefreshCredentials: z.ZodDefault<z.ZodBoolean>;
        }, "strip", z.ZodTypeAny, {
            loginMode?: "callback" | "mcp-gateway";
            autoRefreshCredentials?: boolean;
        }, {
            loginMode?: "callback" | "mcp-gateway";
            autoRefreshCredentials?: boolean;
        }>>;
    }, "strip", z.ZodTypeAny, {
        id?: string;
        email?: string;
        preferences?: {
            loginMode?: "callback" | "mcp-gateway";
            autoRefreshCredentials?: boolean;
        };
    }, {
        id?: string;
        email?: string;
        preferences?: {
            loginMode?: "callback" | "mcp-gateway";
            autoRefreshCredentials?: boolean;
        };
    }>;
    org: z.ZodOptional<z.ZodObject<{
        id: z.ZodString;
    }, "strip", z.ZodTypeAny, {
        id?: string;
    }, {
        id?: string;
    }>>;
}, "strip", z.ZodTypeAny, {
    user?: {
        id?: string;
        email?: string;
        preferences?: {
            loginMode?: "callback" | "mcp-gateway";
            autoRefreshCredentials?: boolean;
        };
    };
    org?: {
        id?: string;
    };
}, {
    user?: {
        id?: string;
        email?: string;
        preferences?: {
            loginMode?: "callback" | "mcp-gateway";
            autoRefreshCredentials?: boolean;
        };
    };
    org?: {
        id?: string;
    };
}>;
declare const credentialsSchema: z.ZodObject<{
    accessToken: z.ZodOptional<z.ZodString>;
    apiKey: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    apiKey?: string;
    accessToken?: string;
}, {
    apiKey?: string;
    accessToken?: string;
}>;
declare const storedConfigSchema: z.ZodObject<{
    api: z.ZodObject<{
        url: z.ZodString;
    }, "strip", z.ZodTypeAny, {
        url?: string;
    }, {
        url?: string;
    }>;
    identity: z.ZodOptional<z.ZodObject<{
        user: z.ZodObject<{
            id: z.ZodString;
            email: z.ZodString;
            preferences: z.ZodDefault<z.ZodObject<{
                loginMode: z.ZodDefault<z.ZodEnum<["callback", "mcp-gateway"]>>;
                autoRefreshCredentials: z.ZodDefault<z.ZodBoolean>;
            }, "strip", z.ZodTypeAny, {
                loginMode?: "callback" | "mcp-gateway";
                autoRefreshCredentials?: boolean;
            }, {
                loginMode?: "callback" | "mcp-gateway";
                autoRefreshCredentials?: boolean;
            }>>;
        }, "strip", z.ZodTypeAny, {
            id?: string;
            email?: string;
            preferences?: {
                loginMode?: "callback" | "mcp-gateway";
                autoRefreshCredentials?: boolean;
            };
        }, {
            id?: string;
            email?: string;
            preferences?: {
                loginMode?: "callback" | "mcp-gateway";
                autoRefreshCredentials?: boolean;
            };
        }>;
        org: z.ZodOptional<z.ZodObject<{
            id: z.ZodString;
        }, "strip", z.ZodTypeAny, {
            id?: string;
        }, {
            id?: string;
        }>>;
    }, "strip", z.ZodTypeAny, {
        user?: {
            id?: string;
            email?: string;
            preferences?: {
                loginMode?: "callback" | "mcp-gateway";
                autoRefreshCredentials?: boolean;
            };
        };
        org?: {
            id?: string;
        };
    }, {
        user?: {
            id?: string;
            email?: string;
            preferences?: {
                loginMode?: "callback" | "mcp-gateway";
                autoRefreshCredentials?: boolean;
            };
        };
        org?: {
            id?: string;
        };
    }>>;
    credentials: z.ZodOptional<z.ZodObject<{
        accessToken: z.ZodOptional<z.ZodString>;
        apiKey: z.ZodOptional<z.ZodString>;
    }, "strip", z.ZodTypeAny, {
        apiKey?: string;
        accessToken?: string;
    }, {
        apiKey?: string;
        accessToken?: string;
    }>>;
}, "strip", z.ZodTypeAny, {
    api?: {
        url?: string;
    };
    identity?: {
        user?: {
            id?: string;
            email?: string;
            preferences?: {
                loginMode?: "callback" | "mcp-gateway";
                autoRefreshCredentials?: boolean;
            };
        };
        org?: {
            id?: string;
        };
    };
    credentials?: {
        apiKey?: string;
        accessToken?: string;
    };
}, {
    api?: {
        url?: string;
    };
    identity?: {
        user?: {
            id?: string;
            email?: string;
            preferences?: {
                loginMode?: "callback" | "mcp-gateway";
                autoRefreshCredentials?: boolean;
            };
        };
        org?: {
            id?: string;
        };
    };
    credentials?: {
        apiKey?: string;
        accessToken?: string;
    };
}>;
declare const configSchema: z.ZodObject<{
    api: z.ZodObject<{
        url: z.ZodString;
    }, "strip", z.ZodTypeAny, {
        url?: string;
    }, {
        url?: string;
    }>;
    identity: z.ZodOptional<z.ZodObject<{
        user: z.ZodObject<{
            id: z.ZodString;
            email: z.ZodString;
            preferences: z.ZodDefault<z.ZodObject<{
                loginMode: z.ZodDefault<z.ZodEnum<["callback", "mcp-gateway"]>>;
                autoRefreshCredentials: z.ZodDefault<z.ZodBoolean>;
            }, "strip", z.ZodTypeAny, {
                loginMode?: "callback" | "mcp-gateway";
                autoRefreshCredentials?: boolean;
            }, {
                loginMode?: "callback" | "mcp-gateway";
                autoRefreshCredentials?: boolean;
            }>>;
        }, "strip", z.ZodTypeAny, {
            id?: string;
            email?: string;
            preferences?: {
                loginMode?: "callback" | "mcp-gateway";
                autoRefreshCredentials?: boolean;
            };
        }, {
            id?: string;
            email?: string;
            preferences?: {
                loginMode?: "callback" | "mcp-gateway";
                autoRefreshCredentials?: boolean;
            };
        }>;
        org: z.ZodOptional<z.ZodObject<{
            id: z.ZodString;
        }, "strip", z.ZodTypeAny, {
            id?: string;
        }, {
            id?: string;
        }>>;
    }, "strip", z.ZodTypeAny, {
        user?: {
            id?: string;
            email?: string;
            preferences?: {
                loginMode?: "callback" | "mcp-gateway";
                autoRefreshCredentials?: boolean;
            };
        };
        org?: {
            id?: string;
        };
    }, {
        user?: {
            id?: string;
            email?: string;
            preferences?: {
                loginMode?: "callback" | "mcp-gateway";
                autoRefreshCredentials?: boolean;
            };
        };
        org?: {
            id?: string;
        };
    }>>;
    credentials: z.ZodOptional<z.ZodObject<{
        accessToken: z.ZodOptional<z.ZodString>;
        apiKey: z.ZodOptional<z.ZodString>;
    }, "strip", z.ZodTypeAny, {
        apiKey?: string;
        accessToken?: string;
    }, {
        apiKey?: string;
        accessToken?: string;
    }>>;
} & {
    app: z.ZodObject<{
        propelAuth: z.ZodObject<{
            url: z.ZodString;
        }, "strip", z.ZodTypeAny, {
            url?: string;
        }, {
            url?: string;
        }>;
        oidc: z.ZodObject<{
            discoveryUrl: z.ZodString;
            clientId: z.ZodString;
            issuer: z.ZodOptional<z.ZodString>;
            redirectUrl: z.ZodOptional<z.ZodString>;
            jwtSecret: z.ZodOptional<z.ZodString>;
            jwtAudience: z.ZodDefault<z.ZodString>;
        }, "strip", z.ZodTypeAny, {
            discoveryUrl?: string;
            clientId?: string;
            issuer?: string;
            redirectUrl?: string;
            jwtSecret?: string;
            jwtAudience?: string;
        }, {
            discoveryUrl?: string;
            clientId?: string;
            issuer?: string;
            redirectUrl?: string;
            jwtSecret?: string;
            jwtAudience?: string;
        }>;
        demoSandbox: z.ZodObject<{
            api: z.ZodObject<{
                url: z.ZodString;
            }, "strip", z.ZodTypeAny, {
                url?: string;
            }, {
                url?: string;
            }>;
            invitationCode: z.ZodString;
        }, "strip", z.ZodTypeAny, {
            api?: {
                url?: string;
            };
            invitationCode?: string;
        }, {
            api?: {
                url?: string;
            };
            invitationCode?: string;
        }>;
        agent: z.ZodObject<{
            agentType: z.ZodEnum<["blaxel", "local"]>;
            url: z.ZodEffects<z.ZodString, string, string>;
            apiKey: z.ZodOptional<z.ZodString>;
        }, "strip", z.ZodTypeAny, {
            url?: string;
            apiKey?: string;
            agentType?: "blaxel" | "local";
        }, {
            url?: string;
            apiKey?: string;
            agentType?: "blaxel" | "local";
        }>;
        posthog: z.ZodOptional<z.ZodObject<{
            apiKey: z.ZodString;
        }, "strip", z.ZodTypeAny, {
            apiKey?: string;
        }, {
            apiKey?: string;
        }>>;
    }, "strip", z.ZodTypeAny, {
        propelAuth?: {
            url?: string;
        };
        oidc?: {
            discoveryUrl?: string;
            clientId?: string;
            issuer?: string;
            redirectUrl?: string;
            jwtSecret?: string;
            jwtAudience?: string;
        };
        demoSandbox?: {
            api?: {
                url?: string;
            };
            invitationCode?: string;
        };
        agent?: {
            url?: string;
            apiKey?: string;
            agentType?: "blaxel" | "local";
        };
        posthog?: {
            apiKey?: string;
        };
    }, {
        propelAuth?: {
            url?: string;
        };
        oidc?: {
            discoveryUrl?: string;
            clientId?: string;
            issuer?: string;
            redirectUrl?: string;
            jwtSecret?: string;
            jwtAudience?: string;
        };
        demoSandbox?: {
            api?: {
                url?: string;
            };
            invitationCode?: string;
        };
        agent?: {
            url?: string;
            apiKey?: string;
            agentType?: "blaxel" | "local";
        };
        posthog?: {
            apiKey?: string;
        };
    }>;
}, "strip", z.ZodTypeAny, {
    api?: {
        url?: string;
    };
    identity?: {
        user?: {
            id?: string;
            email?: string;
            preferences?: {
                loginMode?: "callback" | "mcp-gateway";
                autoRefreshCredentials?: boolean;
            };
        };
        org?: {
            id?: string;
        };
    };
    credentials?: {
        apiKey?: string;
        accessToken?: string;
    };
    app?: {
        propelAuth?: {
            url?: string;
        };
        oidc?: {
            discoveryUrl?: string;
            clientId?: string;
            issuer?: string;
            redirectUrl?: string;
            jwtSecret?: string;
            jwtAudience?: string;
        };
        demoSandbox?: {
            api?: {
                url?: string;
            };
            invitationCode?: string;
        };
        agent?: {
            url?: string;
            apiKey?: string;
            agentType?: "blaxel" | "local";
        };
        posthog?: {
            apiKey?: string;
        };
    };
}, {
    api?: {
        url?: string;
    };
    identity?: {
        user?: {
            id?: string;
            email?: string;
            preferences?: {
                loginMode?: "callback" | "mcp-gateway";
                autoRefreshCredentials?: boolean;
            };
        };
        org?: {
            id?: string;
        };
    };
    credentials?: {
        apiKey?: string;
        accessToken?: string;
    };
    app?: {
        propelAuth?: {
            url?: string;
        };
        oidc?: {
            discoveryUrl?: string;
            clientId?: string;
            issuer?: string;
            redirectUrl?: string;
            jwtSecret?: string;
            jwtAudience?: string;
        };
        demoSandbox?: {
            api?: {
                url?: string;
            };
            invitationCode?: string;
        };
        agent?: {
            url?: string;
            apiKey?: string;
            agentType?: "blaxel" | "local";
        };
        posthog?: {
            apiKey?: string;
        };
    };
}>;
type OidcConfig = z.infer<typeof oidcSchema>;
type PropelAuthConfig = z.infer<typeof propelAuthSchema>;
type PosthogConfig = z.infer<typeof posthogSchema>;
type ApiConfig = z.infer<typeof apiSchema>;
type DemoSandboxConfig = z.infer<typeof demoSandboxSchema>;
type AppConfig = z.infer<typeof appSchema>;
type UserPreferencesConfig = z.infer<typeof userPreferencesSchema>;
type IdentityConfig = z.infer<typeof identitySchema>;
type CredentialsConfig = z.infer<typeof credentialsSchema>;
type StoredConfig = z.infer<typeof storedConfigSchema>;
type Config = z.infer<typeof configSchema>;
declare function maskSensitiveFieldsSerializer(key: string, value: any): any;
declare function masked(config: Config): string;

type AppEnv = "test" | "development" | "production";
type DevMode = "linked" | "source";
declare const appEnv: z.ZodObject<{
    APP_ENV: z.ZodDefault<z.ZodEffects<z.ZodEffects<z.ZodAny, any, any>, any, any>>;
    DEV_MODE: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string, string>, z.ZodEnum<["linked", "source"]>>>;
    ONEGREP_APP_CONFIG: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    APP_ENV?: any;
    DEV_MODE?: "linked" | "source";
    ONEGREP_APP_CONFIG?: string;
}, {
    APP_ENV?: any;
    DEV_MODE?: string;
    ONEGREP_APP_CONFIG?: string;
}>;
declare function getEnv(): z.infer<typeof appEnv>;
declare const getAppConfig: () => Promise<AppConfig>;

/**
 * Validate an API URL by checking if the health check endpoint is reachable.
 * @param url The API URL to validate
 * @returns True if the API URL is valid, false otherwise
 */
declare function validateApiUrl(url: string): Promise<boolean>;
/**
 * Create a raw API Client from a Config object.
 * @param config The config to use to create the client
 * @returns A an initialized OneGrepApiClient
 */
declare function clientFromConfig(config: Config): OneGrepApiClient;
declare function bearerAuthClientFromConfig(config: Config): OneGrepApiHighLevelClient;
declare function apiKeyFromConfig(config: Config): Promise<string>;
declare function isClientAuthenticated(client: OneGrepApiClient): Promise<boolean>;
declare function apiKeyClientFromConfig(config: Config): Promise<OneGrepApiClient>;

interface SecretStorage<T> {
    exists(key: string): Promise<boolean>;
    get(key: string): Promise<T | undefined>;
    set(key: string, value: T): Promise<void>;
    delete(key: string): Promise<void>;
}
declare const newSecretStorage: <T>(schema: z.ZodSchema<T>, location?: "config-dir" | "keyring" | "in-memory") => Promise<SecretStorage<T>>;

/** Responsible for providing the runtime configuration for the CLI that is comprised of
 * any locally cached data that is needed in order to interact with the user's resources.
 *
 * It is responsible for managing the lifecycle of the user's cached config data including items such as:
 * - API Keys
 * - Ephemeral JWTs
 * - User's profile data
 */
declare class ConfigProvider {
    private readonly appConfig;
    private readonly secretStore;
    private configStore;
    constructor(appConfig: AppConfig, secretStore: SecretStorage<StoredConfig>);
    /** Call this method to initialize the config provider. */
    init(): Promise<void>;
    reset(): Promise<void>;
    /**
     * Returns a read-only reference to the current config. The caller should only use
     * explicit setters to update this.
     */
    getConfig(): Promise<Readonly<Config>>;
    update(config: Partial<Config>): Promise<void>;
    updateApiUrl(apiUrl: string): Promise<void>;
    updateIdentity(identity: IdentityConfig): Promise<void>;
    updateCredentials(credentials: CredentialsConfig): Promise<void>;
}

declare class AuthProvider {
    private readonly configProvider;
    private readonly propelAuthProvider;
    constructor(params: {
        configProvider: ConfigProvider;
    });
    getBearerAuthApi(): Promise<OneGrepApiHighLevelClient>;
    getApiKey(): Promise<string>;
    getApiKeyClient(): Promise<OneGrepApiClient>;
    getApi(): Promise<OneGrepApiHighLevelClient>;
    isUserIdentified(): Promise<boolean>;
    isAuthenticated(): Promise<boolean>;
    signup(invitationCode: string, loginMode?: "callback" | "mcp-gateway"): Promise<void>;
    login(loginMode?: "callback" | "mcp-gateway", output?: Console): Promise<void>;
    /**
     * Update the config store with the provided tokens and JWT claims.
     */
    private updateConfigStore;
    /**
     * Logout the user by removing the credentials and identity from the config store.
     *
     * TODO: Call propel auth logout endpoint?
     */
    logout(): Promise<void>;
    openSignupPage(): Promise<void>;
    openLoginPage(): Promise<void>;
    openAccountPage(): Promise<void>;
}

interface AnalyticsProviderImpl {
    capture(event: string, properties?: Record<string, any>): Promise<void>;
    captureException(error: unknown, properties?: Record<string, any>): Promise<void>;
    close(): Promise<void>;
}
declare class AnalyticsProvider implements AnalyticsProviderImpl {
    private configProvider;
    private posthog;
    constructor(params: {
        appConfig: AppConfig;
        configProvider: ConfigProvider;
    });
    private getUserId;
    private getApiUrl;
    private extendProperties;
    capture(event: string, properties?: Record<string, any>): Promise<void>;
    captureException(error: unknown, properties?: Record<string, any>): Promise<void>;
    close(): Promise<void>;
}
/**
 * A dummy analytics provider that does nothing.
 * This is used when the user is in local mode.
 */
declare class DummyAnalyticsProvider implements AnalyticsProviderImpl {
    private configProvider;
    constructor(params: {
        appConfig: AppConfig;
        configProvider: ConfigProvider;
    });
    private getUserId;
    capture(event: string, _?: Record<string, any>): Promise<void>;
    captureException(error: unknown, _?: Record<string, any>): Promise<void>;
    close(): Promise<void>;
}

interface Providers {
    readonly configProvider: ConfigProvider;
    readonly authProvider: AuthProvider;
    readonly analyticsProvider: AnalyticsProviderImpl;
    readonly flagsProvider: ValidatedFlagsProvider;
}
declare class ValidatedFlagsProvider {
    private readonly configProvider;
    private readonly authProvider;
    constructor(configProvider: ConfigProvider, authProvider: AuthProvider);
    /**
     * Lazy-initializes the flags provider because we might not have
     * authentication configured at the time of instantiation.
     */
    private getProvider;
    private isValidFlagName;
    validateFlagName(flagName: string): void;
    all(): Promise<Flags>;
    value(flagName: string): Promise<FlagValue | undefined>;
}
declare function getProviders(): Promise<Providers>;

/**
 * Convenience type for the response from the token endpoint.
 *
 * This is a union of the TokenEndpointResponse and TokenEndpointResponseHelpers
 * from the openid-client library.
 */
type TokensResponse = TokenEndpointResponse & TokenEndpointResponseHelpers;
/**
 * Interface for JWT claims that aligns with the OpenID Connect (OIDC) specification.
 *
 * These fields are defined in the OIDC Core specification:
 * https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims
 *
 * We request the scopes 'openid profile email' which provides access to these claims.
 * The actual claims returned will depend on the identity provider and user permissions.
 */
interface UserJwtClaims {
    sub: string;
    email?: string;
    email_verified?: boolean;
    name?: string;
    given_name?: string;
    family_name?: string;
    middle_name?: string;
    nickname?: string;
    preferred_username?: string;
    profile?: string;
    picture?: string;
    website?: string;
    gender?: string;
    birthdate?: string;
    zoneinfo?: string;
    locale?: string;
    updated_at?: number;
    iat?: number;
    exp?: number;
    iss?: string;
}

/**
 * Extra authentication data for PropelAuthInfo
 */
interface PropelAuthExtra extends Record<string, unknown> {
    userId?: string;
    email?: string;
    propelAccessToken?: string;
    propelRefreshToken?: string;
    apiKey?: string;
    redditAccessToken?: string;
    redditRefreshToken?: string;
}
/**
 * Extended authentication information with Propel-specific data.
 *
 * @remarks
 * This interface extends the base MCP AuthInfo type to include
 * Propel OAuth tokens and user information in the extra field.
 * The extra field is populated after successful OAuth authentication.
 *
 * @example
 * ```typescript
 * const authInfo: PropelAuthInfo = {
 *   clientId: "mcp-client-123",
 *   extra: {
 *     userId: "reddit_username",
 *     redditAccessToken: "access_token_here",
 *     redditRefreshToken: "refresh_token_here"
 *   }
 * };
 * ```
 */
interface PropelAuthInfo extends AuthInfo {
    /**
     * Extra authentication data containing Propel-specific information.
     * Populated after successful OAuth flow completion.
     */
    extra?: PropelAuthExtra;
}
interface PropelAuthUserJwtClaims extends UserJwtClaims {
    user_id?: string;
    org_id_to_org_member_info?: Record<string, unknown>;
}
declare class PropelAuthProvider {
    private readonly configProvider;
    constructor(params: {
        configProvider: ConfigProvider;
    });
    private authClient;
    signupUrl(): Promise<URL>;
    loginUrl(): Promise<URL>;
    accountUrl(): Promise<URL>;
    getAuthInfo(): Promise<AuthenticationInfo | null>;
    isLoggedIn(): Promise<boolean>;
    loginWithOAuthCallback(output?: Console): Promise<{
        tokens: TokensResponse;
        userDetails: PropelAuthUserJwtClaims;
    }>;
    logout(): Promise<void>;
}

/**
 * @file Generic auth store for session management
 * @module auth/auth-store
 *
 * @remarks
 * This module provides a generic store for authentication information that can be accessed
 * by handlers that need authentication context. It supports any type of auth info
 * and provides session-based storage with optional TTL support.
 */
/**
 * Generic authentication store interface
 */
interface IAuthStore<T> {
    /**
     * Store auth info for a session
     */
    set(sessionId: string, authInfo: T): void;
    /**
     * Get auth info for a session
     */
    get(sessionId: string): T | undefined;
    /**
     * Remove auth info for a session
     */
    remove(sessionId: string): void;
    /**
     * Clear all auth info
     */
    clear(): void;
    /**
     * Get all session IDs
     */
    keys(): string[];
    /**
     * Get the number of stored sessions
     */
    size(): number;
    /**
     * Check if a session exists
     */
    has(sessionId: string): boolean;
}
/**
 * Options for creating an auth store
 */
interface AuthStoreOptions {
    /**
     * Time-to-live for sessions in milliseconds
     * If not specified, sessions don't expire
     */
    ttl?: number;
    /**
     * Interval for cleaning up expired sessions in milliseconds
     * Default: 5 minutes
     */
    cleanupInterval?: number;
    /**
     * Maximum number of sessions to store
     * If exceeded, oldest sessions are evicted
     */
    maxSessions?: number;
}
/**
 * Generic in-memory auth store implementation
 */
declare class AuthStore<T> implements IAuthStore<T> {
    private readonly store;
    private readonly options;
    private cleanupTimer?;
    constructor(options?: AuthStoreOptions);
    /**
     * Store auth info for a session
     */
    set(sessionId: string, authInfo: T): void;
    /**
     * Get auth info for a session
     */
    get(sessionId: string): T | undefined;
    /**
     * Remove auth info for a session
     */
    remove(sessionId: string): void;
    /**
     * Clear all auth info
     */
    clear(): void;
    /**
     * Get all session IDs
     */
    keys(): string[];
    /**
     * Get the number of stored sessions
     */
    size(): number;
    /**
     * Check if a session exists
     */
    has(sessionId: string): boolean;
    /**
     * Get all valid (non-expired) sessions
     */
    getAll(): Map<string, T>;
    /**
     * Clean up expired sessions
     */
    cleanup(): void;
    /**
     * Evict the oldest session (based on last accessed time)
     */
    private evictOldestSession;
    /**
     * Start the cleanup timer
     */
    private startCleanupTimer;
    /**
     * Stop the cleanup timer
     */
    destroy(): void;
}
/**
 * Create a simple auth store with default options
 */
declare function createAuthStore<T>(options?: AuthStoreOptions): IAuthStore<T>;
/**
 * Create an auth store specifically for PropelAuthInfo
 * This is a convenience function for the common use case
 */
declare function createPropelAuthStore(options?: AuthStoreOptions): IAuthStore<PropelAuthInfo>;

declare class ConfigStore {
    private readonly secretStore;
    private readonly currentAppConfig;
    private readonly storageKey;
    private mutex;
    constructor(secretStore: SecretStorage<StoredConfig>, currentAppConfig: AppConfig, storageKey?: string);
    init(): Promise<void>;
    load(): Promise<Readonly<Config>>;
    private save;
    update(config: Partial<Config>): Promise<void>;
    clear(): Promise<void>;
}

/**
 * Session authentication information for creating user-specific providers
 */
interface UserSessionAuth {
    accessToken?: string;
    refreshToken?: string;
    apiKey?: string;
    username: string;
    isApiKeyAuth: boolean;
}
/**
 * Creates a complete set of isolated providers for a specific user session.
 * This ensures each user has their own configuration without file persistence
 * or cross-contamination between users.
 *
 * @deprecated Use MultiTenantProviderManager instead for better lifecycle management
 * @param sessionAuth - The user's authentication information
 * @param baseConfig - Optional base configuration to use (defaults to app config)
 * @returns Complete set of providers for the user
 */
declare function createUserProviders(sessionAuth: UserSessionAuth, baseConfig?: Config): Promise<Providers>;
/**
 * Creates user providers from an existing base provider set.
 * This is useful when you want to derive user-specific providers from
 * a global provider configuration.
 *
 * @deprecated Use MultiTenantProviderManager instead for better lifecycle management
 * @param baseProviders - The base providers to derive from
 * @param sessionAuth - The user's authentication information
 * @returns Complete set of providers for the user
 */
declare function createUserProvidersFromBase(baseProviders: Providers, sessionAuth: UserSessionAuth): Promise<Providers>;

/**
 * @file Multi-tenant provider management system
 * @module multi-tenant-provider
 *
 * @remarks
 * This module provides a centralized manager for user-specific providers
 * in a multi-tenant environment. It ensures proper isolation between users
 * while efficiently sharing common resources like app configuration.
 */

/**
 * Options for configuring the multi-tenant provider manager
 */
interface MultiTenantProviderOptions {
    /**
     * Maximum number of concurrent user providers to maintain
     * If exceeded, least recently used providers are evicted
     */
    maxUsers?: number;
    /**
     * Time-to-live for idle providers in milliseconds
     * Providers not accessed within this time are eligible for cleanup
     */
    providerTTL?: number;
    /**
     * Interval for running cleanup operations in milliseconds
     * Default: 5 minutes
     */
    cleanupInterval?: number;
    /**
     * Base API configuration to use for all users
     * If not provided, uses app's demo sandbox config
     */
    baseApiConfig?: Config["api"];
}
/**
 * Interface for multi-tenant provider management
 */
interface IMultiTenantProviderManager {
    /**
     * Get or create providers for a specific user
     * @param userId - The unique identifier for the user
     * @returns Complete set of providers for the user
     */
    getProviders(userId: string): Promise<Providers>;
    /**
     * Update authentication information for a user
     * @param userId - The unique identifier for the user
     * @param authInfo - The authentication information to update
     */
    updateAuth(userId: string, authInfo: PropelAuthInfo): Promise<void>;
    /**
     * Remove all providers for a specific user
     * @param userId - The unique identifier for the user
     */
    removeUser(userId: string): void;
    /**
     * Check if a user has active providers
     * @param userId - The unique identifier for the user
     * @returns true if the user has providers
     */
    hasUser(userId: string): boolean;
    /**
     * Get all active user IDs
     * @returns Array of user IDs with active providers
     */
    getAllUsers(): string[];
    /**
     * Clean up expired providers
     */
    cleanup(): void;
    /**
     * Destroy the manager and clean up all resources
     */
    destroy(): void;
}
/**
 * Multi-tenant provider manager implementation
 *
 * @remarks
 * This class manages provider instances for multiple users in a server environment.
 * It ensures each user has isolated configuration and credentials while sharing
 * common resources like application configuration.
 *
 * @example
 * ```typescript
 * const authStore = createAuthStore<PropelAuthInfo>({ ttl: 3600000 });
 * const manager = new MultiTenantProviderManager(appConfig, authStore);
 *
 * // Get providers for a user
 * const providers = await manager.getProviders("user123");
 *
 * // Update user's auth
 * await manager.updateAuth("user123", newAuthInfo);
 * ```
 */
declare class MultiTenantProviderManager implements IMultiTenantProviderManager {
    private readonly appConfig;
    private readonly authStore;
    private readonly providersCache;
    private readonly options;
    private cleanupTimer?;
    constructor(appConfig: AppConfig, authStore: IAuthStore<PropelAuthInfo>, options?: MultiTenantProviderOptions);
    /**
     * Get or create providers for a specific user
     */
    getProviders(userId: string): Promise<Providers>;
    /**
     * Update authentication information for a user
     */
    updateAuth(userId: string, authInfo: PropelAuthInfo): Promise<void>;
    /**
     * Remove all providers for a specific user
     */
    removeUser(userId: string): void;
    /**
     * Check if a user has active providers
     */
    hasUser(userId: string): boolean;
    /**
     * Get all active user IDs
     */
    getAllUsers(): string[];
    /**
     * Clean up expired providers
     */
    cleanup(): void;
    /**
     * Destroy the manager and clean up all resources
     */
    destroy(): void;
    /**
     * Create providers for a specific user
     */
    private createUserProviders;
    /**
     * Extract credentials from PropelAuthInfo
     */
    private extractCredentials;
    /**
     * Evict the oldest provider based on last accessed time
     */
    private evictOldestProvider;
    /**
     * Start the cleanup timer
     */
    private startCleanupTimer;
}
/**
 * Create a multi-tenant provider manager with default options
 */
declare function createMultiTenantProviderManager(appConfig: AppConfig, authStore: IAuthStore<PropelAuthInfo>, options?: MultiTenantProviderOptions): IMultiTenantProviderManager;

export { AnalyticsProvider, type AnalyticsProviderImpl, type ApiConfig, type AppConfig, type AppEnv, AuthProvider, AuthStore, type AuthStoreOptions, type Config, ConfigProvider, ConfigStore, type CredentialsConfig, type DemoSandboxConfig, type DevMode, DummyAnalyticsProvider, type IAuthStore, type IMultiTenantProviderManager, type IdentityConfig, MultiTenantProviderManager, type MultiTenantProviderOptions, type OidcConfig, type PosthogConfig, type PropelAuthConfig, type PropelAuthExtra, type PropelAuthInfo, PropelAuthProvider, type PropelAuthUserJwtClaims, type Providers, type SecretStorage, type StoredConfig, type UserPreferencesConfig, type UserSessionAuth, agentSchema, apiKeyClientFromConfig, apiKeyFromConfig, apiSchema, appEnv, appSchema, bearerAuthClientFromConfig, clientFromConfig, configSchema, createAuthStore, createMultiTenantProviderManager, createPropelAuthStore, createUserProviders, createUserProvidersFromBase, credentialsSchema, demoSandboxSchema, getAppConfig, getEnv, getProviders, identitySchema, isClientAuthenticated, maskSensitiveFieldsSerializer, masked, newSecretStorage, oidcSchema, orgSchema, posthogSchema, propelAuthSchema, storedConfigSchema, userPreferencesSchema, userSchema, validateApiUrl };