import { type McpToolResult } from "../../_shared/baseToolAdapter.js";
export type McpAuthStrategy = "oauth" | "api-key" | "bearer-token" | "custom";
export type McpAuthenticatePermission = "mcp:connect" | "mcp:auth";
export type McpAuthenticateContext = {
    runtimeId?: string;
    sessionId?: string;
    invocationId?: string;
    dryRun?: boolean;
    guard?: {
        accepted?: boolean;
        allowed?: boolean;
        reason?: string;
    };
    allowedServerIds?: readonly string[];
    allowedScopes?: readonly string[];
    grantedPermissions?: readonly McpAuthenticatePermission[];
    auditMetadata?: Readonly<Record<string, unknown>>;
};
export type McpAuthenticateTarget = {
    serverId: string;
    authStrategy: McpAuthStrategy;
    credentialRef: string;
    requestedScopes: readonly string[];
};
export type McpAuthenticateRequest = {
    target?: Partial<McpAuthenticateTarget> | null;
    context?: McpAuthenticateContext;
};
export type McpAuthenticateProviderResult = {
    status: "authenticated" | "already_authenticated" | "pending";
    serverId?: string;
    authSessionId?: string;
    expiresAt?: string;
    scopesGranted?: readonly string[];
    providerMetadata?: Readonly<Record<string, unknown>>;
    raw?: unknown;
};
export type McpAuthenticateProvider = (request: McpAuthenticateTarget, context: Readonly<Record<string, unknown>>) => Promise<McpAuthenticateProviderResult> | McpAuthenticateProviderResult;
export type McpAuthenticateOutput = {
    kind: "agentCore.basicTool.mcp.authenticate";
    target: McpAuthenticateTarget;
    dryRun: boolean;
    executionBlocked: boolean;
    providerCalled: boolean;
    permissionsRequired: readonly McpAuthenticatePermission[];
    unsafeSideEffects: true;
    credentialMaterialAccepted: false;
    tokenIssued: boolean;
    authEnvelope: {
        serverId: string;
        authStrategy: McpAuthStrategy;
        credentialRef: string;
        requestedScopes: readonly string[];
        state: "planned" | "authenticated" | "already_authenticated" | "pending";
        authSessionId?: string;
        expiresAt?: string;
        scopesGranted?: readonly string[];
        source: "dry-run" | "runtime-provider";
    };
    providerMetadata?: Readonly<Record<string, unknown>>;
};
export type McpAuthenticateErrorCode = "INVALID_REQUEST" | "INVALID_CONTEXT" | "MISSING_SERVER_ID" | "INVALID_SERVER_ID" | "INVALID_AUTH_STRATEGY" | "MISSING_CREDENTIAL_REF" | "INVALID_REQUESTED_SCOPES" | "SCOPE_REJECTED" | "PERMISSION_DENIED" | "GOVERNANCE_REJECTED" | "REAL_EXECUTION_BLOCKED" | "PROVIDER_UNAVAILABLE" | "PROVIDER_REJECTED";
export type McpAuthenticateResult = McpToolResult<McpAuthenticateOutput, McpAuthenticateErrorCode>;
export declare const mcpAuthenticateDescriptor: {
    readonly toolId: "mcp.authenticate";
    readonly capability: "authenticate-mcp-server";
    readonly route: "agent_executionEngine.basic_toolLayer.baseTools.mcpBase.auth";
    readonly permissionsRequired: readonly ["mcp:connect", "mcp:auth"];
    readonly defaultDryRun: true;
    readonly acceptsRawSecrets: false;
    readonly tapOwnsApproval: true;
};
export declare function planMcpAuthenticate(request?: unknown): McpAuthenticateResult;
export declare function executeMcpAuthenticate(request?: unknown, provider?: McpAuthenticateProvider): Promise<McpAuthenticateResult>;
