/** OAuth 2.1 provider configuration (persisted to data/global/auth-config.json). */
export interface AuthConfig {
    /** OAuth 2.1 client ID registered with the provider. */
    clientId: string;
    /** Authorization endpoint URL (PKCE flow). */
    authorizationUrl: string;
    /** Token endpoint URL. */
    tokenUrl: string;
    /** Introspection endpoint URL (optional — used for opaque tokens). */
    introspectionUrl?: string;
    /** JWKS endpoint URL (optional — used for JWT validation). */
    jwksUrl?: string;
    /** Scopes requested at authorization time. */
    scopes: string[];
    /** Mapping of OAuth scope → list of tool names accessible. */
    scopeMappings: Record<string, string[]>;
    /** ISO 8601 timestamp when this config was last updated. */
    updatedAt: string;
}
/** Result of validating an access token. */
export interface TokenValidationResult {
    /** Whether the token is valid and active. */
    valid: boolean;
    /** Subject identifier (user/client ID) from the token. */
    subject?: string;
    /** Scopes granted by this token. */
    scopes: string[];
    /** Unix timestamp (seconds) when the token expires. */
    expiresAt?: number;
    /** Reason for rejection (present when valid is false). */
    reason?: string;
}
/** A single OAuth scope definition. */
export interface OAuthScope {
    /** Scope string as sent to the provider (e.g. "planu:write"). */
    name: string;
    /** Human-readable description of what this scope grants. */
    description: string;
}
/** Maps an OAuth scope to a set of tool names. */
export interface ScopeMapping {
    /** The OAuth scope string. */
    scope: string;
    /** Tool names accessible when this scope is granted. */
    tools: string[];
}
/** Input for the configure_auth tool. */
export interface ConfigureAuthInput {
    /** OAuth 2.1 client ID. */
    clientId: string;
    /** Authorization endpoint URL. */
    authorizationUrl: string;
    /** Token endpoint URL. */
    tokenUrl: string;
    /** Introspection endpoint URL (for opaque tokens). */
    introspectionUrl?: string;
    /** JWKS URI (for JWT validation). */
    jwksUrl?: string;
    /** Scopes to request. */
    scopes: string[];
    /** Optional scope → tools mapping. */
    scopeMappings?: Record<string, string[]>;
}
/** Generated PKCE challenge parameters. */
export interface PkceChallenge {
    /** The code verifier (random secret, kept by client). */
    codeVerifier: string;
    /** The code challenge (S256 = BASE64URL(SHA-256(verifier))). */
    codeChallenge: string;
    /** Always "S256" for OAuth 2.1 compliance. */
    codeChallengeMethod: 'S256';
}
/** Auth middleware context passed through the request pipeline. */
export interface AuthContext {
    /** Whether auth is configured and enforced. */
    enabled: boolean;
    /** Token validation result (present when a Bearer token was provided). */
    validation?: TokenValidationResult;
    /** Tool names the caller is authorized to use (empty = all allowed). */
    allowedTools: string[];
}
//# sourceMappingURL=auth.d.ts.map