import { Effect, Layer, Schema } from "effect";
import { HttpClient } from "effect/unstable/http";
import { createPkceCodeChallenge, type OAuthEndpointUrlPolicy } from "./oauth-helpers";
declare const OAuthDiscoveryError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
    readonly _tag: "OAuthDiscoveryError";
} & Readonly<A>;
/** Separate tag from `OAuth2Error` so callers can distinguish discovery
 *  / DCR failures (happen once, before any token round-trips) from
 *  token-endpoint failures. A plugin's refresh path should never have
 *  to inspect error messages to tell "metadata drifted, re-discover"
 *  apart from "refresh token is no longer honoured". */
export declare class OAuthDiscoveryError extends OAuthDiscoveryError_base<{
    readonly message: string;
    readonly status?: number;
    /** RFC 6749 §5.2 / RFC 7591 §3.2.2 error code, when the AS returned
     *  one (`invalid_client_metadata`, `invalid_redirect_uri`, ...). Lets
     *  the HTTP edge surface a structured error to the UI rather than
     *  swallow the AS's response into a generic message string. */
    readonly error?: string;
    readonly errorDescription?: string;
    readonly cause?: unknown;
}> {
}
export declare const OAuthProtectedResourceMetadataSchema: Schema.Struct<{
    readonly resource: Schema.optional<Schema.String>;
    readonly authorization_servers: Schema.optional<Schema.$Array<Schema.String>>;
    readonly scopes_supported: Schema.optional<Schema.$Array<Schema.String>>;
    readonly bearer_methods_supported: Schema.optional<Schema.$Array<Schema.String>>;
    readonly resource_documentation: Schema.optional<Schema.String>;
}>;
export type OAuthProtectedResourceMetadata = typeof OAuthProtectedResourceMetadataSchema.Type;
export declare const OAuthAuthorizationServerMetadataSchema: Schema.Struct<{
    readonly issuer: Schema.String;
    readonly authorization_endpoint: Schema.String;
    readonly token_endpoint: Schema.String;
    readonly registration_endpoint: Schema.optional<Schema.String>;
    readonly scopes_supported: Schema.optional<Schema.$Array<Schema.String>>;
    readonly response_types_supported: Schema.optional<Schema.$Array<Schema.String>>;
    readonly grant_types_supported: Schema.optional<Schema.$Array<Schema.String>>;
    readonly code_challenge_methods_supported: Schema.optional<Schema.$Array<Schema.String>>;
    readonly token_endpoint_auth_methods_supported: Schema.optional<Schema.$Array<Schema.String>>;
    readonly revocation_endpoint: Schema.optional<Schema.String>;
    readonly introspection_endpoint: Schema.optional<Schema.String>;
    readonly userinfo_endpoint: Schema.optional<Schema.String>;
    readonly id_token_signing_alg_values_supported: Schema.optional<Schema.$Array<Schema.String>>;
}>;
export type OAuthAuthorizationServerMetadata = typeof OAuthAuthorizationServerMetadataSchema.Type;
export type DynamicClientMetadata = {
    readonly client_name?: string;
    readonly redirect_uris: readonly string[];
    readonly grant_types?: readonly string[];
    readonly response_types?: readonly string[];
    readonly token_endpoint_auth_method?: "none" | "client_secret_basic" | "client_secret_post" | "private_key_jwt";
    readonly scope?: string;
    readonly application_type?: "web" | "native";
    readonly client_uri?: string;
    readonly logo_uri?: string;
    readonly contacts?: readonly string[];
    readonly software_id?: string;
    readonly software_version?: string;
    /** Escape hatch for provider-specific extensions; merged last. */
    readonly extra?: Readonly<Record<string, unknown>>;
};
export declare const OAuthClientInformationSchema: Schema.Struct<{
    readonly client_id: Schema.String;
    readonly client_secret: Schema.optional<Schema.String>;
    readonly client_id_issued_at: Schema.optional<Schema.Number>;
    readonly client_secret_expires_at: Schema.optional<Schema.Number>;
    readonly registration_access_token: Schema.optional<Schema.String>;
    readonly registration_client_uri: Schema.optional<Schema.String>;
    readonly token_endpoint_auth_method: Schema.optional<Schema.String>;
    readonly grant_types: Schema.optional<Schema.$Array<Schema.String>>;
    readonly response_types: Schema.optional<Schema.$Array<Schema.String>>;
    readonly redirect_uris: Schema.optional<Schema.$Array<Schema.String>>;
    readonly client_name: Schema.optional<Schema.String>;
    readonly scope: Schema.optional<Schema.String>;
}>;
export type OAuthClientInformation = typeof OAuthClientInformationSchema.Type;
export interface DiscoveryRequestOptions {
    /** Injected for tests. Defaults to the platform fetch-backed HttpClient. */
    readonly httpClientLayer?: Layer.Layer<HttpClient.HttpClient>;
    /** Abort the request after this many ms. Default 20000. */
    readonly timeoutMs?: number;
    /** Send `MCP-Protocol-Version: <value>` on every request. Harmless
     *  for non-MCP servers; required by the MCP authorization spec. */
    readonly mcpProtocolVersion?: string;
    /** Credentials needed to reach the protected resource itself. These
     *  are intentionally used only for resource-side probes, never for
     *  authorization-server metadata, DCR, authorization, or token calls. */
    readonly resourceHeaders?: Readonly<Record<string, string>>;
    readonly resourceQueryParams?: Readonly<Record<string, string>>;
    readonly endpointUrlPolicy?: OAuthEndpointUrlPolicy;
}
export declare const discoverProtectedResourceMetadata: (resourceUrl: string, options?: DiscoveryRequestOptions) => Effect.Effect<{
    readonly metadataUrl: string;
    readonly metadata: OAuthProtectedResourceMetadata;
} | null, OAuthDiscoveryError>;
export declare const discoverAuthorizationServerMetadata: (issuer: string, options?: DiscoveryRequestOptions) => Effect.Effect<{
    readonly metadataUrl: string;
    readonly metadata: OAuthAuthorizationServerMetadata;
} | null, OAuthDiscoveryError>;
export interface RegisterDynamicClientInput {
    readonly registrationEndpoint: string;
    readonly metadata: DynamicClientMetadata;
    readonly initialAccessToken?: string | null;
}
export declare const registerDynamicClient: (input: RegisterDynamicClientInput, options?: DiscoveryRequestOptions) => Effect.Effect<OAuthClientInformation, OAuthDiscoveryError>;
export declare const canonicalResourceUrl: (value: string) => string;
export interface DynamicAuthorizationState {
    readonly resourceMetadata: OAuthProtectedResourceMetadata | null;
    readonly resourceMetadataUrl: string | null;
    readonly authorizationServerUrl: string;
    readonly authorizationServerMetadataUrl: string;
    readonly authorizationServerMetadata: OAuthAuthorizationServerMetadata;
    readonly clientInformation: OAuthClientInformation;
    /** RFC 8707 canonical resource URL passed on /authorize and persisted
     *  for the matching /token + refresh calls. */
    readonly resource: string;
    /** Scopes ultimately requested at /authorize. Persisted so refresh
     *  can replay the same set. */
    readonly scopes: readonly string[];
}
export interface DynamicAuthorizationStartResult {
    readonly authorizationUrl: string;
    readonly codeVerifier: string;
    readonly state: DynamicAuthorizationState;
}
export interface BeginDynamicAuthorizationInput {
    readonly endpoint: string;
    readonly redirectUrl: string;
    /** RFC 6749 `state` — callers typically pass a per-session random id. */
    readonly state: string;
    /** Defaults: `redirect_uris=[redirectUrl]`, `token_endpoint_auth_method="none"`
     *  (public client + PKCE). */
    readonly clientMetadata?: Partial<DynamicClientMetadata>;
    /** Scopes to request. Defaults to `scopes_supported`; omitted if
     *  neither is set. */
    readonly scopes?: readonly string[];
    /** Pre-existing state from a previous flow. When provided, the
     *  matching discovery / DCR step is skipped so multi-user sign-ins
     *  against the same source don't re-pay those costs. */
    readonly previousState?: {
        readonly authorizationServerUrl?: string | null;
        readonly authorizationServerMetadata?: OAuthAuthorizationServerMetadata | null;
        readonly authorizationServerMetadataUrl?: string | null;
        readonly resourceMetadata?: OAuthProtectedResourceMetadata | null;
        readonly resourceMetadataUrl?: string | null;
        readonly clientInformation?: OAuthClientInformation | null;
        readonly resource?: string | null;
        readonly scopes?: readonly string[] | null;
    };
}
export declare const beginDynamicAuthorization: (input: BeginDynamicAuthorizationInput, options?: DiscoveryRequestOptions) => Effect.Effect<DynamicAuthorizationStartResult, OAuthDiscoveryError>;
export { createPkceCodeChallenge };
//# sourceMappingURL=oauth-discovery.d.ts.map