/**
 * MCP OAuth 2.0 + PKCE implementation.
 *
 * Implements the OAuth 2.0 Authorization Code flow with PKCE (RFC 7636)
 * for authenticating with MCP servers that require OAuth.
 *
 * Flow:
 *   1. Generate code_verifier (43-128 chars, URL-safe random)
 *   2. Derive code_challenge = base64url(SHA-256(code_verifier))
 *   3. Build authorize URL with challenge
 *   4. User authenticates in browser → redirect with auth code
 *   5. Exchange code + verifier for tokens
 *   6. Auto-refresh on 401 using refresh_token
 */
/**
 * Generate a cryptographically random code_verifier (43-128 characters).
 * Uses URL-safe base64 characters per RFC 7636 §4.1.
 */
export declare function generateCodeVerifier(length?: number): string;
/**
 * Derive code_challenge from code_verifier using S256 method.
 * code_challenge = base64url(SHA-256(code_verifier))
 */
export declare function deriveCodeChallenge(codeVerifier: string): string;
export interface OAuthServerConfig {
    /** Authorization endpoint URL. */
    authorizeUrl: string;
    /** Token endpoint URL. */
    tokenUrl: string;
    /** Client ID (from DCR or pre-registered). */
    clientId: string;
    /** Client secret (optional, for confidential clients). */
    clientSecret?: string;
    /** Redirect URI for the OAuth callback. */
    redirectUri: string;
    /** OAuth scopes to request. */
    scopes?: string[];
}
export interface TokenSet {
    accessToken: string;
    refreshToken?: string;
    expiresAt?: number;
    tokenType: string;
    scope?: string;
}
export interface OAuthClient {
    /** Build the authorization URL for the user to visit. */
    buildAuthorizeUrl(): {
        url: string;
        codeVerifier: string;
        state: string;
    };
    /** Exchange an authorization code for tokens. */
    exchangeCode(code: string, codeVerifier: string): Promise<TokenSet>;
    /** Refresh an expired access token using the refresh token. */
    refreshAccessToken(refreshToken: string): Promise<TokenSet>;
    /** Check if a token set is expired (or will expire within bufferMs). */
    isExpired(tokens: TokenSet, bufferMs?: number): boolean;
}
/**
 * Create an OAuth 2.0 + PKCE client for the given server configuration.
 */
export declare function createOAuthClient(config: OAuthServerConfig): OAuthClient;
//# sourceMappingURL=oauth.d.ts.map