import { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';
import { OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
import { Logger } from '@n8n/backend-common';
import { TransactionRunner, UserRepository } from '@n8n/db';
import { JwtService } from '../../services/jwt.service';
import type { OAuthTokenVerifier, UserWithContext } from '../../services/oauth-token-verifier-proxy.service';
import { ProtectedResourceRegistry } from '../../services/protected-resource.registry';
import { AccessTokenRepository } from './database/repositories/oauth-access-token.repository';
import { RefreshTokenRepository } from './database/repositories/oauth-refresh-token.repository';
export declare class OAuthTokenService implements OAuthTokenVerifier {
    private readonly logger;
    private readonly jwtService;
    private readonly userRepository;
    private readonly accessTokenRepository;
    private readonly refreshTokenRepository;
    private readonly resourceRegistry;
    private readonly txRunner;
    private readonly ACCESS_TOKEN_EXPIRY_SECONDS;
    private readonly REFRESH_TOKEN_EXPIRY_MS;
    constructor(logger: Logger, jwtService: JwtService, userRepository: UserRepository, accessTokenRepository: AccessTokenRepository, refreshTokenRepository: RefreshTokenRepository, resourceRegistry: ProtectedResourceRegistry, txRunner: TransactionRunner);
    getAccessTokenExpirySeconds(): number;
    generateTokenPair(userId: string, clientId: string, resource: string | undefined, scopes: string[]): {
        accessToken: string;
        refreshToken: string;
    };
    saveTokenPair(accessToken: string, refreshToken: string, clientId: string, userId: string, scopes: string[]): Promise<void>;
    validateAndRotateRefreshToken(refreshToken: string, clientId: string, resource?: string): Promise<OAuthTokens>;
    verifyAccessToken(token: string, expectedAudience?: string): Promise<AuthInfo>;
    private verifyTokenWithAudiences;
    private parseScopeClaim;
    verifyOAuthAccessToken(token: string, expectedAudience?: string): Promise<UserWithContext>;
    revokeAllTokensForGrant(clientId: string, userId: string): Promise<void>;
    revokeAccessToken(token: string, clientId: string): Promise<boolean>;
    revokeRefreshToken(token: string, clientId: string): Promise<boolean>;
    private getAllowedAudiences;
    private audiencesForResource;
    private getResourceByAudience;
    private verifyJwtWithAllowedAudiences;
    private getStringClaim;
}