export declare const MCP_HTTP_PATH = "/api/bridge/mcp";
export declare const OAUTH_SCOPE = "mcp";
export declare const PROTECTED_RESOURCE_PATH = "/.well-known/oauth-protected-resource/api/bridge/mcp";
export declare const AUTHORIZATION_SERVER_PATH = "/.well-known/oauth-authorization-server";
export declare const AUTHORIZE_PATH = "/bridge/oauth/authorize";
export declare const TOKEN_PATH = "/api/bridge/oauth/token";
export interface AuthorizeInput {
    responseType: string;
    clientId: string;
    redirectUri: string;
    codeChallenge: string;
    codeChallengeMethod: string;
    resource: string;
    scope: string;
    state: string;
}
export type OauthFailure = {
    ok: false;
    status: number;
    error: string;
    description: string;
};
export type AuthorizeOk = {
    ok: true;
    scope: string;
    resource: string;
    issuer: string;
    redirectUri: string;
};
export declare function originOf(base: string): string;
export declare function mcpResourceIdentifier(origin: string): string;
export declare function protectedResourceMetadata(origin: string): Record<string, unknown>;
export declare function authorizationServerMetadata(origin: string): Record<string, unknown>;
export declare function pkceS256(verifier: string): string;
export declare function listOauthRedirectUris(): string[];
export declare function acceptableRedirectUri(raw: string): string | null;
export declare function addOauthRedirectUri(raw: string): Promise<{
    ok: true;
    redirectUris: string[];
} | {
    ok: false;
    error: string;
}>;
export declare function removeOauthRedirectUri(raw: string): Promise<string[]>;
/** Reject anything that is not authorization-code + S256, then the allowlist. */
export declare function evaluateAuthorize(input: AuthorizeInput, origin: string | null): Promise<OauthFailure | AuthorizeOk>;
export declare function issueAuthorizationCode(input: {
    challenge: string;
    redirectUri: string;
    clientId: string;
    resource: string;
    scope: string;
    subject: string;
}): Promise<string | null>;
export interface TokenRequest {
    grantType: string;
    code: string;
    redirectUri: string;
    clientId: string;
    codeVerifier: string;
    resource: string;
    clientSecret: string;
    clientAssertion: string;
}
export declare function exchangeAuthorizationCode(input: TokenRequest): Promise<OauthFailure | {
    ok: true;
    accessToken: string;
    expiresIn: number;
    scope: string;
}>;
/** Bridge tokens (agim_…) are never access tokens. */
export declare function readAccessToken(raw: string, resource: string): {
    subject: string;
    scope: string;
} | null;
/** Test hook. Production fetches the client metadata document over HTTPS. */
export declare function setOauthMetadataFetcherForTests(fn: ((url: string) => Promise<Record<string, unknown> | null>) | null): void;
//# sourceMappingURL=bridge-mcp-oauth.d.ts.map