import { type JWK } from "jose";
import { type AuthorizationServerStore, type AuthorizationGrantRecord, type AuthorizationTransactionRecord, type OAuthAuthorizationServerSigningKey } from "../../mcp-oauth-server/dist/index.js";
import type { HttpAdditionalRequestHandler, TinyHttpMcpServerOAuthOptions } from "../../tiny-http-mcp-server/dist/server.js";
export type HostedOAuthLoginFieldName = "email" | "password" | "apiKey" | (string & {});
export interface HostedOAuthLoginField {
    name: HostedOAuthLoginFieldName;
    label?: string;
    type?: "text" | "email" | "password";
}
export interface HostedOAuthCredentialStore<TCredential = unknown> {
    get(subject: string): Promise<TCredential | undefined>;
    set(subject: string, credential: TCredential): Promise<void>;
    delete(subject: string): Promise<void>;
    update(subject: string, update: (credential: TCredential) => Promise<TCredential> | TCredential): Promise<TCredential>;
}
export interface HostedOAuthStorageCapabilities {
    durable: boolean;
    encryptedCredentials: boolean;
    stableKeys: boolean;
    shared: boolean;
}
export interface HostedOAuthInteractionStore {
    set(transaction: AuthorizationTransactionRecord): Promise<void>;
    get(transactionId: string): Promise<AuthorizationTransactionRecord | undefined>;
    delete(transactionId: string): Promise<void>;
}
export interface HostedOAuthStorage<TCredential = unknown> {
    authorizationServer: AuthorizationServerStore;
    interactions: HostedOAuthInteractionStore;
    credentials: HostedOAuthCredentialStore<TCredential>;
    capabilities: HostedOAuthStorageCapabilities;
    signingKey(): Promise<OAuthAuthorizationServerSigningKey>;
    resolveSubject(providerName: string, accountId: string): Promise<string>;
    healthCheck?(): Promise<void>;
    cleanup?(now?: number): Promise<void>;
    onGrantRevoked?(grant: AuthorizationGrantRecord): Promise<void> | void;
}
export interface HostedOAuthCredentialAccess<TCredential = unknown> {
    read(): Promise<TCredential>;
    update(update: (credential: TCredential) => Promise<TCredential> | TCredential): Promise<TCredential>;
    delete(): Promise<void>;
}
export interface HostedOAuthIdentity {
    issuer: string;
    subject: string;
    clientId: string;
    scopes: readonly string[];
    resource: string;
}
export interface HostedOAuthProvider<TCredential = unknown, TServices extends object = object> {
    name: string;
    login?: {
        fields: readonly (HostedOAuthLoginFieldName | HostedOAuthLoginField)[];
    };
    connect?(fields: Readonly<Record<string, string>> & {
        signal: AbortSignal;
    }): Promise<{
        accountId: string;
        credential: TCredential;
    }>;
    services(input: {
        credentials: HostedOAuthCredentialAccess<TCredential>;
        identity: HostedOAuthIdentity;
    }): Promise<Partial<TServices>> | Partial<TServices>;
}
export interface HostedOAuthInteractionAdapter<TCredential = unknown> {
    paths: readonly string[];
    start(context: {
        request: Request;
        transaction: AuthorizationTransactionRecord;
    }): Promise<Response> | Response;
    handle(context: {
        request: Request;
        complete(input: {
            transactionId: string;
            accountId: string;
            credential: TCredential;
        }): Promise<Response>;
    }): Promise<Response> | Response;
}
export interface HostedOAuthAdvancedOptions<TCredential = unknown> {
    scopes?: readonly string[];
    branding?: {
        title?: string;
    };
    accessTokenTtlSeconds?: number;
    authorizationCodeTtlSeconds?: number;
    authorizationTransactionTtlSeconds?: number;
    refreshTokenTtlSeconds?: number;
    additionalPublicJwks?: readonly JWK[];
    interaction?: HostedOAuthInteractionAdapter<TCredential>;
}
export interface HostedOAuthOptions<TCredential = unknown, TServices extends object = object> {
    publicUrl: string;
    storage: HostedOAuthStorage<TCredential>;
    provider: HostedOAuthProvider<TCredential, TServices>;
    advanced?: HostedOAuthAdvancedOptions<TCredential>;
}
export interface PreparedHostedOAuth {
    publicUrl: URL;
    issuer: URL;
    scopes: readonly string[];
}
export interface HostedOAuthConfiguration<TCredential = unknown, TServices extends object = object> extends HostedOAuthOptions<TCredential, TServices> {
    readonly kind: "hosted";
    prepare(options?: {
        production?: boolean;
    }): Promise<PreparedHostedOAuth>;
    assertProductionReady(): Promise<PreparedHostedOAuth>;
}
export declare function isHostedOAuthConfiguration(value: unknown): value is HostedOAuthConfiguration<unknown, object>;
export declare function hostedOAuth<TCredential = unknown, TServices extends object = object>(options: HostedOAuthOptions<TCredential, TServices>): HostedOAuthConfiguration<TCredential, TServices>;
export declare class HostedOAuthLoginError extends Error {
    constructor(message: string);
}
export interface HostedOAuthRuntime<TServices extends object = object> {
    mcpPath: string;
    oauth: TinyHttpMcpServerOAuthOptions;
    requestHandler: HttpAdditionalRequestHandler;
    requestServices(identity: HostedOAuthIdentity): Promise<Partial<TServices>>;
}
export declare function createInMemoryHostedOAuthStorage<TCredential = unknown>(options: {
    development: true;
}): HostedOAuthStorage<TCredential>;