/**
 * @license
 * Copyright 2025 Steven Roussey <sroussey@gmail.com>
 * SPDX-License-Identifier: Apache-2.0
 *
 * Shared MCP authentication type definitions and JSON Schema.
 */
/**
 * Supported MCP authentication types.
 */
export declare const mcpAuthTypes: readonly ["none", "bearer", "client_credentials", "private_key_jwt", "static_private_key_jwt", "authorization_code"];
export type McpAuthType = (typeof mcpAuthTypes)[number];
export interface McpAuthNone {
    readonly type: "none";
}
export interface McpAuthBearer {
    readonly type: "bearer";
    /** Static token or credential-store key (format: "credential"). */
    readonly token: string;
}
export interface McpAuthClientCredentials {
    readonly type: "client_credentials";
    readonly client_id: string;
    /** Client secret or credential-store key (format: "credential"). */
    readonly client_secret: string;
    readonly client_name?: string;
    readonly scope?: string;
}
export interface McpAuthPrivateKeyJwt {
    readonly type: "private_key_jwt";
    readonly client_id: string;
    /** PEM / JWK private key or credential-store key (format: "credential"). */
    readonly private_key: string;
    readonly algorithm: string;
    readonly client_name?: string;
    readonly jwt_lifetime_seconds?: number;
    readonly scope?: string;
}
export interface McpAuthStaticPrivateKeyJwt {
    readonly type: "static_private_key_jwt";
    readonly client_id: string;
    /** Pre-built JWT assertion or credential-store key (format: "credential"). */
    readonly jwt_bearer_assertion: string;
    readonly client_name?: string;
    readonly scope?: string;
}
export interface McpAuthAuthorizationCode {
    readonly type: "authorization_code";
    readonly client_id: string;
    readonly client_secret?: string;
    readonly redirect_url: string;
    readonly scope?: string;
}
export type McpAuthConfig = McpAuthNone | McpAuthBearer | McpAuthClientCredentials | McpAuthPrivateKeyJwt | McpAuthStaticPrivateKeyJwt | McpAuthAuthorizationCode;
export declare const mcpAuthConfigSchema: {
    readonly properties: {
        readonly auth_type: {
            readonly type: "string";
            readonly enum: readonly ["none", "bearer", "client_credentials", "private_key_jwt", "static_private_key_jwt", "authorization_code"];
            readonly title: "Auth Type";
            readonly description: "Authentication method for connecting to the MCP server";
        };
        readonly auth_token: {
            readonly type: "string";
            readonly format: "credential";
            readonly title: "Bearer Token";
            readonly description: "Static bearer token or API key (for bearer auth)";
        };
        readonly auth_client_id: {
            readonly type: "string";
            readonly title: "Client ID";
            readonly description: "OAuth client ID (for OAuth auth types)";
        };
        readonly auth_client_secret: {
            readonly type: "string";
            readonly format: "credential";
            readonly title: "Client Secret";
            readonly description: "OAuth client secret (for client_credentials auth)";
        };
        readonly auth_private_key: {
            readonly type: "string";
            readonly format: "credential";
            readonly title: "Private Key";
            readonly description: "PEM or JWK private key (for private_key_jwt auth)";
        };
        readonly auth_algorithm: {
            readonly type: "string";
            readonly title: "Algorithm";
            readonly description: "JWT signing algorithm, e.g. RS256, ES256 (for private_key_jwt auth)";
        };
        readonly auth_jwt_bearer_assertion: {
            readonly type: "string";
            readonly format: "credential";
            readonly title: "JWT Assertion";
            readonly description: "Pre-built JWT assertion (for static_private_key_jwt auth)";
        };
        readonly auth_redirect_url: {
            readonly type: "string";
            readonly format: "uri";
            readonly title: "Redirect URL";
            readonly description: "OAuth redirect URL (for authorization_code auth)";
        };
        readonly auth_scope: {
            readonly type: "string";
            readonly title: "Scope";
            readonly description: "OAuth scope (space-separated)";
        };
        readonly auth_client_name: {
            readonly type: "string";
            readonly title: "Client Name";
            readonly description: "Optional OAuth client display name";
        };
        readonly auth_jwt_lifetime_seconds: {
            readonly type: "number";
            readonly title: "JWT Lifetime";
            readonly description: "JWT lifetime in seconds (default: 300)";
            readonly minimum: 1;
        };
    };
    readonly allOf: readonly [{
        readonly if: {
            readonly properties: {
                readonly auth_type: {
                    readonly const: "bearer";
                };
            };
            readonly required: readonly ["auth_type"];
        };
        readonly then: {
            readonly required: readonly ["auth_token"];
            readonly properties: {
                readonly auth_token: true;
            };
        };
    }, {
        readonly if: {
            readonly properties: {
                readonly auth_type: {
                    readonly const: "client_credentials";
                };
            };
            readonly required: readonly ["auth_type"];
        };
        readonly then: {
            readonly required: readonly ["auth_client_id", "auth_client_secret"];
            readonly properties: {
                readonly auth_client_id: true;
                readonly auth_client_secret: true;
                readonly auth_client_name: true;
                readonly auth_scope: true;
            };
        };
    }, {
        readonly if: {
            readonly properties: {
                readonly auth_type: {
                    readonly const: "private_key_jwt";
                };
            };
            readonly required: readonly ["auth_type"];
        };
        readonly then: {
            readonly required: readonly ["auth_client_id", "auth_private_key", "auth_algorithm"];
            readonly properties: {
                readonly auth_client_id: true;
                readonly auth_private_key: true;
                readonly auth_algorithm: true;
                readonly auth_client_name: true;
                readonly auth_jwt_lifetime_seconds: true;
                readonly auth_scope: true;
            };
        };
    }, {
        readonly if: {
            readonly properties: {
                readonly auth_type: {
                    readonly const: "static_private_key_jwt";
                };
            };
            readonly required: readonly ["auth_type"];
        };
        readonly then: {
            readonly required: readonly ["auth_client_id", "auth_jwt_bearer_assertion"];
            readonly properties: {
                readonly auth_client_id: true;
                readonly auth_jwt_bearer_assertion: true;
                readonly auth_client_name: true;
                readonly auth_scope: true;
            };
        };
    }, {
        readonly if: {
            readonly properties: {
                readonly auth_type: {
                    readonly const: "authorization_code";
                };
            };
            readonly required: readonly ["auth_type"];
        };
        readonly then: {
            readonly required: readonly ["auth_client_id", "auth_redirect_url"];
            readonly properties: {
                readonly auth_client_id: true;
                readonly auth_client_secret: true;
                readonly auth_redirect_url: true;
                readonly auth_scope: true;
            };
        };
    }];
};
/**
 * Constructs a typed McpAuthConfig from flat schema properties.
 * Used by `createMcpClient()` to normalize the config.
 * Returns `undefined` if required fields for the selected auth type are missing.
 */
export declare function buildAuthConfig(flat: Record<string, unknown>): McpAuthConfig | undefined;
//# sourceMappingURL=McpAuthTypes.d.ts.map