/**
 * OAuth2 token management service.
 *
 * Handles token refresh and caching for Google and Microsoft OAuth2/XOAUTH2.
 * Uses native fetch (Node 22+) — no external HTTP dependencies.
 */
import type { OAuth2Config } from '../types/index.js';
interface ProviderEndpoints {
    tokenUrl: string;
    authUrl: string;
    scopes: string[];
}
export default class OAuthService {
    /**
     * Refreshes already in progress, keyed by the config object they belong to.
     *
     * Several callers share one account: the IMAP client, the SMTP transport,
     * their two connection tests, and the IDLE watcher. When a token expires
     * they can arrive together and each start its own refresh. That is not
     * merely a wasted request — providers that rotate the refresh token on use
     * invalidate the loser's copy, and Microsoft rate-limits refreshes, so the
     * account can end up unable to authenticate at all. Concurrent callers get
     * the same in-flight promise instead, as ImapService does for its label
     * strategy. Keyed weakly so a dropped account config is not retained.
     */
    private pendingRefreshes;
    /**
     * Get a valid access token, refreshing if expired.
     */
    getAccessToken(oauth2: OAuth2Config): Promise<string>;
    /**
     * Check if the cached access token is expired or missing.
     */
    static isTokenExpired(oauth2: OAuth2Config): boolean;
    /**
     * Exchange refresh token for a new access token.
     */
    static refreshAccessToken(oauth2: OAuth2Config): Promise<{
        accessToken: string;
        expiresIn: number;
    }>;
    /**
     * Get provider endpoints for token exchange and authorization.
     */
    static getProviderEndpoints(oauth2: OAuth2Config): ProviderEndpoints;
    /**
     * Generate an OAuth2 authorization URL for the CLI setup wizard.
     */
    static generateAuthUrl(oauth2: OAuth2Config, redirectUri: string): string;
    /**
     * Exchange an authorization code for tokens (initial setup).
     */
    static exchangeCode(oauth2: OAuth2Config, code: string, redirectUri: string): Promise<{
        accessToken: string;
        refreshToken: string;
        expiresIn: number;
    }>;
}
export {};
//# sourceMappingURL=oauth.service.d.ts.map