import { type OAuthClientProvider, type DpopSession, type OAuthClientInformationContext, type OAuthClientMetadata, type OAuthDiscoveryState, type StoredOAuthClientInformation, type StoredOAuthTokens } from "@modelcontextprotocol/client";
import { type ServerConfig, type ClientOptions } from "./config.js";
export type OAuthOptions = Pick<ClientOptions, "oauthScopes" | "oauthCallbackPort" | "oauthDpop">;
export declare function callbackUrl(options?: OAuthOptions): string;
/** Validate the full handoff URL before giving the response to the SDK. */
export declare function parseCallback(value: string, redirect: string, state: string): URLSearchParams;
export interface OAuthIdentity {
    server: string;
    url: string;
    clientId?: string;
}
export interface SecretStore {
    read(): string | null;
    write(value: string): void;
    remove(): void;
}
export type CredentialStoreFactory = (identity: OAuthIdentity) => Promise<SecretStore>;
export declare function credentialKey({ server, url, clientId }: OAuthIdentity): string;
export declare function credentialStore(identity: OAuthIdentity): Promise<SecretStore>;
export declare class OAuthProvider implements OAuthClientProvider {
    private readonly store;
    private readonly redirect?;
    private readonly options;
    readonly redirectUrl: string;
    readonly clientMetadata: OAuthClientMetadata;
    private data;
    private snapshot;
    private readonly epoch;
    private readonly key;
    private verifier?;
    private discovery?;
    private requestedScope?;
    private dpopSession?;
    private resolvedDpopSession?;
    readonly expectedState: `${string}-${string}-${string}-${string}-${string}`;
    private readonly clientId?;
    constructor(identity: OAuthIdentity, store: SecretStore, redirect?: ((url: URL) => void | Promise<void>) | undefined, options?: OAuthOptions);
    private assertCurrent;
    private save;
    state(): `${string}-${string}-${string}-${string}-${string}`;
    clientInformation(ctx?: OAuthClientInformationContext): ({
        client_id: string;
        client_secret?: string | undefined;
        client_id_issued_at?: number | undefined;
        client_secret_expires_at?: number | undefined;
    } & {
        issuer?: string;
    }) | undefined;
    private lookupClientInformation;
    saveClientInformation(info: StoredOAuthClientInformation, ctx?: OAuthClientInformationContext): void;
    tokens(ctx?: OAuthClientInformationContext): StoredOAuthTokens | undefined;
    saveTokens(tokens: StoredOAuthTokens): void;
    dpop(): Promise<DpopSession | undefined>;
    saveCodeVerifier(value: string): void;
    codeVerifier(): string;
    saveDiscoveryState(value: OAuthDiscoveryState): void;
    discoveryState(): OAuthDiscoveryState | undefined;
    redirectToAuthorization(url: URL): Promise<void>;
    invalidateCredentials(scope: "all" | "client" | "tokens" | "verifier" | "discovery"): void;
}
/** Reuse stored tokens without requiring a working keyring for public servers.
 * Only explicit login may register a client or open a browser; background
 * authentication may reuse or refresh existing grants through the SDK.
 */
export declare function connectionAuthProvider(server: string, config: ServerConfig, storeFactory?: CredentialStoreFactory): Promise<OAuthClientProvider | undefined>;
export type Revocation = "confirmed" | "unsupported" | "unconfirmed" | "not-needed";
/** Local removal is unconditional; revocation is bounded, issuer-bound, and best effort. */
export declare function logout(identity: OAuthIdentity, store: SecretStore, signal?: AbortSignal): Promise<Revocation>;
/** Explicit user action only; OAuth never opens a browser during search or execution. */
export declare function authenticate(identity: OAuthIdentity, open: (url: string) => Promise<void>, signal?: AbortSignal, store?: SecretStore, options?: OAuthOptions & {
    handoff?: (authorizationUrl: string, signal: AbortSignal) => Promise<string | undefined>;
}): Promise<void>;