import { Request, Response, Router } from "express";

//#region src/lib/oauth.d.ts
interface McpOAuthHandlers {
  authorize(req: Request, res: Response, config: McpOAuthConfig): void | Promise<void>;
  token(req: Request, res: Response, config: McpOAuthConfig): void | Promise<void>;
  revoke(req: Request, res: Response, config: McpOAuthConfig): void | Promise<void>;
  register?(req: Request, res: Response, config: McpOAuthConfig): void | Promise<void>;
}
interface McpOAuthConfig {
  /** Pre-provisioned OAuth client_id */
  clientId: string;
  /** Pre-provisioned OAuth client_secret */
  clientSecret: string;
  /** MCP server base URL as seen by the client (used in metadata). If not set, derived from request. */
  mcpServerBaseUrl?: string;
  /** Default scopes to request when the MCP client doesn't specify any */
  defaultScopes?: string[];
  /** If true, always use defaultScopes and ignore scopes sent by the MCP client */
  forceDefaultScopes?: boolean;
  /** Validate an OAuth token. Return true if valid, false if expired/invalid. Called on every POST /mcp when oauth=true and a token is present. */
  tokenValidator?: (token: string) => Promise<boolean>;
  /** Handler implementations for authorize, token, revoke, and optionally register */
  handlers: McpOAuthHandlers;
}
/**
 * Mount MCP OAuth endpoints required by the MCP spec:
 * - GET /.well-known/oauth-authorization-server — RFC 8414 metadata
 * - GET {mcpPath}/authorize — delegates to handlers.authorize
 * - POST {mcpPath}/token — delegates to handlers.token
 * - POST {mcpPath}/revoke — delegates to handlers.revoke
 * - POST {mcpPath}/register — delegates to handlers.register (or default pre-provisioned fallback)
 */
declare function mountMcpOAuth(app: Router, mcpPath: string, config: McpOAuthConfig): void;
//#endregion
export { McpOAuthConfig, McpOAuthHandlers, mountMcpOAuth };
//# sourceMappingURL=oauth.d.ts.map