/**
 * OAuthDeviceFlow.ts (D12 — OAuth Device Flow)
 *
 * Implements the OAuth 2.0 Device Authorization Grant (RFC 8628).
 * Used for desktop MCP clients where browser-based login is preferred
 * over manually copying API keys.
 *
 * Flow:
 *   1. Client requests a device code from the auth server
 *   2. User opens a URL in their browser and enters the code
 *   3. Client polls until the user completes authorization
 *   4. Client receives an access token and stores it in OS keychain
 *
 * Dependencies:
 *   - D9 (OS Keychain Wrapper) for secure token storage
 *   - Auth server must support device_authorization_endpoint
 *
 * Usage:
 *   sentinel-mcp-server login    → starts device flow
 *   sentinel-mcp-server logout   → removes stored token
 *   sentinel-mcp-server status   → shows auth status
 */
export interface DeviceAuthConfig {
    /** OAuth authorization server base URL */
    authServerUrl: string;
    /** OAuth client ID (public client, no secret needed) */
    clientId: string;
    /** Requested scopes */
    scopes: string[];
}
interface DeviceCodeResponse {
    device_code: string;
    user_code: string;
    verification_uri: string;
    verification_uri_complete?: string;
    expires_in: number;
    interval: number;
}
interface TokenResponse {
    access_token: string;
    token_type: string;
    expires_in?: number;
    refresh_token?: string;
    scope?: string;
}
export declare class OAuthDeviceFlow {
    private config;
    constructor(config: DeviceAuthConfig);
    /**
     * Step 1: Request a device code from the authorization server.
     */
    requestDeviceCode(): Promise<DeviceCodeResponse>;
    /**
     * Step 2: Poll for token after user authorizes in browser.
     * Returns the access token once the user completes authorization.
     * Throws if the request expires or is denied.
     */
    pollForToken(deviceCode: string, interval: number, expiresIn: number): Promise<TokenResponse>;
    /**
     * Step 3: Refresh an expired access token using the refresh token.
     */
    refreshToken(refreshToken: string): Promise<TokenResponse>;
    /**
     * Full login flow: request code → prompt user → poll → return token.
     * Caller is responsible for storing the token (e.g., in OS keychain).
     */
    login(): Promise<TokenResponse>;
    private sleep;
}
/**
 * Handle `sentinel-mcp-server login|logout|status` subcommands.
 * Called from server.ts when a CLI auth argument is detected.
 */
export declare function handleAuthCommand(command: string): Promise<void>;
export {};