/**
 * @license
 * Copyright 2025 Steven Roussey <sroussey@gmail.com>
 * SPDX-License-Identifier: Apache-2.0
 *
 * MCP OAuth provider adapter backed by ICredentialStore, and factory function.
 */
import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";
import type { AddClientAuthentication, OAuthClientProvider, OAuthDiscoveryState } from "@modelcontextprotocol/sdk/client/auth.js";
export { UnauthorizedError };
export type { OAuthClientProvider };
import type { OAuthClientInformationMixed, OAuthClientMetadata, OAuthTokens } from "@modelcontextprotocol/sdk/shared/auth.js";
import type { ICredentialStore } from "@workglow/util";
import type { McpAuthConfig } from "./McpAuthTypes";
/**
 * OAuthClientProvider backed by ICredentialStore.
 *
 * Stores tokens, client info, code verifiers, and discovery state as JSON
 * strings under namespaced keys. Enables token persistence across
 * short-lived MCP connections that share the same server URL.
 */
export declare class CredentialStoreOAuthProvider implements OAuthClientProvider {
    private readonly store;
    private readonly serverUrl;
    private readonly _clientMetadata;
    private readonly _redirectUrl;
    private readonly _initialClientInfo;
    /** Optional override for grant-specific token request preparation. */
    prepareTokenRequest?: (scope?: string) => URLSearchParams | Promise<URLSearchParams | undefined> | undefined;
    /** Optional override for custom client authentication on token requests. */
    addClientAuthentication?: AddClientAuthentication;
    constructor(options: {
        store: ICredentialStore;
        serverUrl: string;
        clientMetadata: OAuthClientMetadata;
        redirectUrl?: string | URL;
        initialClientInfo?: OAuthClientInformationMixed;
        prepareTokenRequest?: OAuthClientProvider["prepareTokenRequest"];
        addClientAuthentication?: AddClientAuthentication;
    });
    get redirectUrl(): string | URL | undefined;
    get clientMetadata(): OAuthClientMetadata;
    clientInformation(): Promise<OAuthClientInformationMixed | undefined>;
    saveClientInformation(info: OAuthClientInformationMixed): Promise<void>;
    tokens(): Promise<OAuthTokens | undefined>;
    saveTokens(tokens: OAuthTokens): Promise<void>;
    redirectToAuthorization(authorizationUrl: URL): Promise<void>;
    saveCodeVerifier(codeVerifier: string): Promise<void>;
    codeVerifier(): Promise<string>;
    saveDiscoveryState(state: OAuthDiscoveryState): Promise<void>;
    discoveryState(): Promise<OAuthDiscoveryState | undefined>;
    invalidateCredentials(scope: "all" | "client" | "tokens" | "verifier" | "discovery"): Promise<void>;
}
/**
 * Creates an OAuthClientProvider for the given auth config, or returns
 * `undefined` when no provider is needed (none / bearer).
 *
 * Bearer auth is handled at the transport level via request headers,
 * so this function returns `undefined` for it.
 */
export declare function createAuthProvider(auth: McpAuthConfig, serverUrl: string, credentialStore?: ICredentialStore): OAuthClientProvider | undefined;
/**
 * Resolves credential-store keys in auth config to actual secret values.
 *
 * This is needed for the standalone MCP task path where config properties
 * are NOT auto-resolved by `resolveSchemaInputs`. For the AgentTask path,
 * credential resolution happens automatically via `format: "credential"`.
 */
export declare function resolveAuthSecrets(auth: McpAuthConfig, credentialStore?: ICredentialStore): Promise<McpAuthConfig>;
//# sourceMappingURL=McpAuthProvider.d.ts.map