/**
 * OAuth 2.0 provider for the Reverse Centaur MCP server.
 *
 * Implements the OAuthServerProvider interface from the MCP SDK.
 * Users authorize by entering their Reverse Centaur API key on a
 * simple consent page. The key is validated, and an access token is
 * issued that the MCP client (e.g. Claude) uses for subsequent requests.
 *
 * For Anthropic reviewers: use API key "rc_test_anthropic_review_2026"
 * to activate mock mode with sample data.
 */
import type { Response } from 'express';
import type { OAuthRegisteredClientsStore } from '@modelcontextprotocol/sdk/server/auth/clients.js';
import type { OAuthServerProvider, AuthorizationParams } from '@modelcontextprotocol/sdk/server/auth/provider.js';
import type { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';
import type { OAuthClientInformationFull, OAuthTokens, OAuthTokenRevocationRequest } from '@modelcontextprotocol/sdk/shared/auth.js';
export declare const TEST_API_KEY = "rc_test_anthropic_review_2026";
export declare class ClientsStore implements OAuthRegisteredClientsStore {
    private clients;
    getClient(clientId: string): Promise<{
        redirect_uris: string[];
        client_id: string;
        token_endpoint_auth_method?: string | undefined;
        grant_types?: string[] | undefined;
        response_types?: string[] | undefined;
        client_name?: string | undefined;
        client_uri?: string | undefined;
        logo_uri?: string | undefined;
        scope?: string | undefined;
        contacts?: string[] | undefined;
        tos_uri?: string | undefined;
        policy_uri?: string | undefined;
        jwks_uri?: string | undefined;
        jwks?: any;
        software_id?: string | undefined;
        software_version?: string | undefined;
        software_statement?: string | undefined;
        client_secret?: string | undefined;
        client_id_issued_at?: number | undefined;
        client_secret_expires_at?: number | undefined;
    } | undefined>;
    registerClient(client: Omit<OAuthClientInformationFull, 'client_id' | 'client_id_issued_at'>): Promise<OAuthClientInformationFull>;
}
export declare class ReversecentaurOAuthProvider implements OAuthServerProvider {
    readonly clientsStore: ClientsStore;
    private codes;
    private tokens;
    private apiKeyToToken;
    /**
     * Validate an API key. In production this would hit the real API;
     * here we accept the test key plus any key starting with "rc_".
     */
    private isValidApiKey;
    /**
     * Renders a minimal consent page where the user enters their API key.
     * On submit, the form POSTs back to the same URL with the key.
     */
    authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void>;
    challengeForAuthorizationCode(_client: OAuthClientInformationFull, authorizationCode: string): Promise<string>;
    exchangeAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string): Promise<OAuthTokens>;
    exchangeRefreshToken(): Promise<OAuthTokens>;
    verifyAccessToken(token: string): Promise<AuthInfo>;
    revokeToken(_client: OAuthClientInformationFull, request: OAuthTokenRevocationRequest): Promise<void>;
    /**
     * Look up the API key associated with a verified access token.
     * Used by the HTTP server to configure the MCP server in the right mode.
     */
    getApiKeyForToken(token: string): string | undefined;
    private renderPage;
}
//# sourceMappingURL=oauth-provider.d.ts.map