/**
 * MCP Authentication for NotebookLM MCP Server
 *
 * Provides authentication for MCP requests:
 * - Token-based authentication
 * - Auto-generated tokens on first run
 * - Secure token storage (hashed)
 * - Rate limiting for failed auth attempts
 *
 * Added by Pantheon Security for hardened fork.
 */
/**
 * MCP Auth configuration
 */
export interface MCPAuthConfig {
    /** Enable authentication (default: true — secure by default) */
    enabled: boolean;
    /** Admin token from environment or file */
    token?: string;
    /** Optional read-only token for non-destructive tools */
    readOnlyToken?: string;
    /** Path to token file */
    tokenFile: string;
    /** Max failed auth attempts before lockout */
    maxFailedAttempts: number;
    /** Lockout duration in milliseconds (initial — escalates with exponential backoff) */
    lockoutDurationMs: number;
}
export type MCPAuthScope = "read" | "admin";
export declare class MCPAuthenticator {
    private config;
    private tokenHash;
    private readOnlyTokenHash;
    private failedAttempts;
    private initialized;
    private hashSalt;
    private rotationTimer?;
    private unknownTracker;
    constructor(config?: Partial<MCPAuthConfig>);
    private loadOrCreateSalt;
    /**
     * Initialize the authenticator
     */
    initialize(): Promise<void>;
    private startPeriodicRotation;
    /**
     * Print token setup instructions to stderr
     */
    private printTokenInstructions;
    /**
     * Generate a secure random token
     */
    generateToken(): string;
    /**
     * Hash a token using SHA3-256 (quantum-resistant).
     * NOTE: changing this algorithm invalidates all stored token hashes — users
     * must re-run setup_auth or rotate their token after upgrading.
     */
    hashToken(token: string): string;
    /**
     * Save token hash to file
     */
    private saveTokenHash;
    /**
     * Check if authentication is enabled
     */
    isEnabled(): boolean;
    /**
     * Check if a client identifier is locked out
     */
    private isLockedOut;
    /**
     * Record a failed authentication attempt
     *
     * Uses exponential backoff for lockout duration:
     * 1st lockout: 5min, 2nd: 15min, 3rd: 45min, 4th+: 4hr (capped)
     */
    private recordFailedAttempt;
    /**
     * Clear failed attempts for a client (after successful auth)
     */
    private clearFailedAttempts;
    /**
     * Validate a token
     *
     * @param token - Token to validate
     * @param clientId - Client identifier for rate limiting (default: "unknown")
     * @param forceValidation - If true, validate even when auth is globally disabled (for sensitive tools)
     * @returns true if valid, false if invalid
     */
    validateToken(token: string | undefined, clientId?: string, forceValidation?: boolean): Promise<boolean>;
    validateTokenScope(token: string | undefined, clientId?: string, requiredScope?: MCPAuthScope, forceValidation?: boolean): Promise<{
        valid: boolean;
        scope?: MCPAuthScope;
        error?: string;
    }>;
    /**
     * Get authentication status for health check
     */
    getStatus(): {
        enabled: boolean;
        hasToken: boolean;
        hasReadOnlyToken: boolean;
        lockedClients: number;
    };
    /**
     * Rotate the authentication token.
     *
     * Records a ChangeLog entry for SOC2 change-management audit trail.
     * The token itself is never logged; only "[rotated]" markers appear
     * in the change record.
     */
    rotateToken(): Promise<string>;
}
/**
 * Get or create the global authenticator
 */
export declare function getMCPAuthenticator(): MCPAuthenticator;
/**
 * Middleware function for MCP request authentication
 *
 * @param token - The auth token to validate
 * @param clientId - Client identifier for rate limiting
 * @param forceAuth - If true, require auth even when globally disabled (for sensitive tools)
 */
export declare function authenticateMCPRequest(token: string | undefined, clientId?: string, forceAuth?: boolean, requiredScope?: MCPAuthScope): Promise<{
    authenticated: boolean;
    error?: string;
}>;
/**
 * CLI handler for `npx notebooklm-mcp token <subcommand>`
 *
 * Subcommands:
 *   show    — Generate a new token (or show instructions to retrieve the current one)
 *   rotate  — Rotate the token and display the new one
 *   (none)  — Print help
 */
export declare function handleTokenCommand(args: string[]): Promise<void>;