/** Error codes raised by the loopback callback server. */
export type OAuthCallbackErrorCode = 
/** No callback arrived within `timeoutMs`; a retry is reasonable. */
"TIMEOUT"
/** Callback `state` did not match `expectedState`. Surface a generic failure — do NOT echo the expected value. */
 | "STATE_MISMATCH"
/** Callback carried `?error=...`. `details` holds `error` and optionally `error_description` for display. */
 | "PROVIDER_ERROR"
/** Callback had no `code` parameter; treat as a malformed response. */
 | "MISSING_CODE"
/** Could not bind the loopback port. No retry — environment likely blocked. */
 | "BIND_FAILED"
/** Caller's `AbortSignal` fired. Expected; no user-facing message. */
 | "ABORTED";
/** Options for `OAuthCallbackError`. */
export interface OAuthCallbackErrorOptions {
    /** Structured metadata for callers that want to surface specific fields. */
    details?: Record<string, string>;
    /** Underlying error that triggered this failure. */
    cause?: unknown;
}
/**
 * Error raised by the loopback callback server when the authorization
 * response cannot be consumed (timeout, state mismatch, provider error,
 * malformed response, bind failure, or caller abort).
 */
export declare class OAuthCallbackError extends Error {
    /** Discriminator for programmatic handling. */
    readonly code: OAuthCallbackErrorCode;
    /** Structured metadata carried alongside the error, if any. */
    readonly details?: Record<string, string>;
    constructor(code: OAuthCallbackErrorCode, message: string, options?: OAuthCallbackErrorOptions);
}
/** Error codes raised by the OAuth flow orchestrator and its helpers. */
export type OAuthFlowErrorCode = 
/** OIDC discovery could not reach or parse the authorization server. No browser was opened. */
"DISCOVERY_FAILED"
/** Could not launch the system browser. User should be told to open the URL manually. */
 | "BROWSER_LAUNCH_FAILED"
/** Authorization code → token exchange was rejected by the authorization server. */
 | "TOKEN_EXCHANGE_FAILED"
/** System keychain is unavailable (e.g. no D-Bus secret service on Linux). */
 | "KEYRING_UNAVAILABLE"
/** OAuth blob is too large for the OS keystore (Windows Credential Manager: 2560 UTF-16 chars per entry, MAX_CHUNKS chunks max). The keystore itself is healthy; the IDP is issuing tokens with too many claims. */
 | "TOKEN_TOO_LARGE"
/** Authorization endpoint returned by discovery cannot be used (e.g. already carries an OAuth-required param). Server misconfiguration. */
 | "INVALID_AUTHORIZATION_ENDPOINT"
/** No usable stored credentials; the user needs to run `login` to re-authenticate. Covers empty / corrupt / version-mismatched store and refresh tokens the authorization server has revoked. */
 | "NOT_AUTHENTICATED";
/** Options for `OAuthFlowError`. */
export interface OAuthFlowErrorOptions {
    /** Structured metadata for callers that want to surface specific fields. */
    details?: Record<string, string>;
    /** Underlying error that triggered this failure. */
    cause?: unknown;
}
/**
 * Error raised by anything in the OAuth flow outside the callback
 * server itself: OIDC discovery, browser launch, token exchange, or
 * keychain access.
 *
 * **Logging note.** For code `TOKEN_EXCHANGE_FAILED`, `message` may
 * include the authorization server's `error_description`, which is
 * free-form text the server controls and could plausibly contain
 * user-identifying or otherwise sensitive information. Prefer
 * structured logging via the discriminated `code` and the explicit
 * `details` fields; avoid echoing the raw `message` (or the result
 * of `console.error(err)`, which includes it) into shared log sinks
 * without a redaction step.
 */
export declare class OAuthFlowError extends Error {
    /** Discriminator for programmatic handling. */
    readonly code: OAuthFlowErrorCode;
    /** Structured metadata carried alongside the error, if any. */
    readonly details?: Record<string, string>;
    constructor(code: OAuthFlowErrorCode, message: string, options?: OAuthFlowErrorOptions);
}