/**
 * Generic OAuth flow for MCP servers.
 *
 * Allows users to authenticate with any OAuth-compatible MCP server
 * by providing authorization URL, token URL, and client credentials.
 */
import { OAuthCallbackFlow } from "@pk-nerdsaver-ai/pi-ai/oauth/callback-server";
import type { OAuthController, OAuthCredentials } from "@pk-nerdsaver-ai/pi-ai/oauth/types";
import type { FetchImpl } from "@pk-nerdsaver-ai/pi-ai/types";
import type { OAuthCredential } from "../session/auth-storage";
/**
 * Deterministic credential id for an MCP server URL scoped to an OMP profile.
 *
 * Local profile stores are already separate, but auth-broker storage shares one
 * provider namespace across profiles. Including the profile in the provider key
 * keeps a shared project `mcp.json` definition from making profile B overwrite
 * or read profile A's OAuth row for the same server URL. The URL is used
 * verbatim (query string included) because it can carry tenant selectors such
 * as `?project_ref=`.
 */
export declare function mcpOAuthCredentialId(serverUrl: string, profile?: string | undefined): string;
/** Whether a credential id was minted by OMP's MCP OAuth flows (either era). */
export declare function isManagedMCPOAuthCredentialId(credentialId: string | undefined): credentialId is string;
/**
 * Profile segment of a profile-scoped `mcp_oauth:profile:<profile>:<serverUrl>`
 * credential id, or `undefined` for legacy non-profile-scoped managed ids
 * (`mcp_oauth:<url>`, `mcp_oauth_<rand>`). The server URL itself contains `:`
 * and `/`, so only the segment between the prefix and the FIRST subsequent `:`
 * is the profile; everything after it is the URL.
 */
export declare function mcpOAuthCredentialProfile(credentialId: string): string | undefined;
/**
 * Stored MCP OAuth credential. Refresh material is embedded so token refresh
 * works without any `auth` block persisted in (possibly shared) config files.
 */
export interface MCPStoredOAuthCredential extends OAuthCredential {
    tokenUrl?: string;
    clientId?: string;
    clientSecret?: string;
    resource?: string;
}
export interface MCPOAuthConfig {
    /** Authorization endpoint URL */
    authorizationUrl: string;
    /** Token endpoint URL */
    tokenUrl: string;
    /** Client ID (optional when already embedded in authorization URL) */
    clientId?: string;
    /** Client secret (optional for PKCE flows) */
    clientSecret?: string;
    /** OAuth scopes (space-separated) */
    scopes?: string;
    /**
     * `prompt` parameter for the authorization request. Defaults to `"consent"`
     * so the provider always shows its authorize screen instead of silently
     * re-approving the browser's current session — without it, reauthorizing to
     * switch accounts/workspaces is impossible once a session cookie exists
     * (RFC 6749 §3.1 requires servers to ignore the param when unsupported).
     * Set to `""` to omit the parameter entirely.
     */
    prompt?: string;
    /** Exact redirect URI to advertise to the provider */
    redirectUri?: string;
    /** Custom callback port (default: 3000) */
    callbackPort?: number;
    /** Custom callback path (default: /callback or redirectUri pathname) */
    callbackPath?: string;
    /** MCP resource URI for RFC 8707 resource indicators */
    resource?: string;
    /** Fetch implementation for token exchange and discovery requests. */
    fetch?: FetchImpl;
}
/**
 * Generic OAuth flow for MCP servers.
 * Supports standard OAuth 2.0 authorization code flow with PKCE.
 */
export declare class MCPOAuthFlow extends OAuthCallbackFlow {
    #private;
    private config;
    constructor(config: MCPOAuthConfig, ctrl: OAuthController);
    /**
     * Client id used during the authorization request. Returns the value supplied
     * via {@link MCPOAuthConfig.clientId} or, when the server required dynamic
     * client registration, the id issued during registration. `undefined` until
     * {@link generateAuthUrl} (or {@link login}) has run for a server that needs
     * a client id.
     */
    get resolvedClientId(): string | undefined;
    /**
     * Client secret issued by dynamic client registration, if any. Always
     * `undefined` for PKCE-only/public clients and when the caller supplies the
     * client id via config.
     */
    get registeredClientSecret(): string | undefined;
    get resource(): string | undefined;
    generateAuthUrl(state: string, redirectUri: string): Promise<{
        url: string;
        instructions?: string;
    }>;
    exchangeToken(code: string, _state: string, redirectUri: string): Promise<OAuthCredentials>;
}
/**
 * Refresh an MCP OAuth token using the standard refresh_token grant.
 * Returns updated credentials; preserves the old refresh token if the server doesn't rotate it.
 */
export declare function refreshMCPOAuthToken(tokenUrl: string, refreshToken: string, clientId?: string, clientSecret?: string, resourceOrOpts?: string | {
    fetch?: FetchImpl;
}, opts?: {
    fetch?: FetchImpl;
}): Promise<OAuthCredentials>;
