/**
 * MCP OAuth 2.1 Client Provider
 *
 * Implements OAuthClientProvider for MCP servers following the 2025-03-26 spec.
 * Supports:
 * - PKCE (required by OAuth 2.1)
 * - Dynamic Client Registration (RFC 7591)
 * - Token storage and refresh
 * - Browser-based authorization with local callback server
 * - Manual code entry fallback for headless environments
 */
import type { OAuthClientProvider } from '@modelcontextprotocol/sdk/client/auth.js';
import type { OAuthClientMetadata, OAuthClientInformation, OAuthClientInformationFull, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
/**
 * Configuration for the MCP OAuth provider
 */
export interface MCPOAuthConfig {
    /** MCP server URL */
    serverUrl: string;
    /** Client name shown during authorization */
    clientName?: string;
    /** Requested scopes */
    scopes?: string[];
    /** Local callback port (default: 9876) */
    callbackPort?: number;
    /** Storage directory for tokens (default: ~/.ncp/auth) */
    storageDir?: string;
    /** Pre-registered client ID (optional - if not provided, uses dynamic registration) */
    clientId?: string;
    /** Pre-registered client secret (optional) */
    clientSecret?: string;
}
/**
 * MCP OAuth Client Provider Implementation
 *
 * Handles the full OAuth 2.1 flow for MCP servers:
 * 1. Discovers protected resource metadata
 * 2. Discovers authorization server metadata
 * 3. Dynamically registers client (if needed)
 * 4. Performs PKCE authorization
 * 5. Stores and refreshes tokens
 */
export declare class MCPOAuthProvider implements OAuthClientProvider {
    private config;
    private oauthState;
    private callbackServer?;
    private serverKey;
    constructor(config: MCPOAuthConfig);
    /**
     * Create a unique key for storing server-specific OAuth state
     */
    private createServerKey;
    /**
     * Get the redirect URL for OAuth callbacks
     */
    get redirectUrl(): string;
    /**
     * Get client metadata for registration
     */
    get clientMetadata(): OAuthClientMetadata;
    /**
     * Generate OAuth state parameter
     */
    state(): Promise<string>;
    /**
     * Load stored client information
     */
    clientInformation(): Promise<OAuthClientInformation | undefined>;
    /**
     * Save client information after dynamic registration
     */
    saveClientInformation(clientInfo: OAuthClientInformationFull): Promise<void>;
    /**
     * Load stored tokens
     */
    tokens(): Promise<OAuthTokens | undefined>;
    /**
     * Save tokens after authorization
     */
    saveTokens(tokens: OAuthTokens): Promise<void>;
    /**
     * Redirect user to authorization URL
     *
     * For CLI environments:
     * 1. Start local callback server
     * 2. Open browser with authorization URL
     * 3. Wait for callback with authorization code
     */
    redirectToAuthorization(authorizationUrl: URL): Promise<void>;
    /**
     * Save PKCE code verifier
     */
    saveCodeVerifier(codeVerifier: string): Promise<void>;
    /**
     * Load PKCE code verifier
     */
    codeVerifier(): Promise<string>;
    /**
     * Invalidate stored credentials
     */
    invalidateCredentials(scope: 'all' | 'client' | 'tokens' | 'verifier'): Promise<void>;
    /**
     * Start callback server and wait for authorization code
     *
     * Returns a promise that resolves with the authorization code
     * when the user completes authorization in their browser.
     */
    waitForCallback(timeoutMs?: number): Promise<string>;
    /**
     * Stop the callback server
     */
    private stopCallbackServer;
    /**
     * Open URL in default browser
     */
    private openBrowser;
    /**
     * Load state from disk
     */
    private loadState;
    /**
     * Save state to disk
     */
    private saveState;
    /**
     * Check if we have valid tokens
     */
    hasValidTokens(): Promise<boolean>;
    /**
     * Get current access token (if available)
     */
    getAccessToken(): Promise<string | undefined>;
    /**
     * Clear all stored state for this server
     */
    clearState(): Promise<void>;
}
/**
 * Create an MCP OAuth provider instance
 */
export declare function createMCPOAuthProvider(config: MCPOAuthConfig): MCPOAuthProvider;
//# sourceMappingURL=mcp-oauth-provider.d.ts.map