/**
 * OAuth 2.0 device authorization grant (RFC 8628).
 *
 * The right flow for a CLI. Authorization-code needs a redirect URI and a local
 * web server; client-credentials gets app-only permissions, which for
 * "summarize *my* mail" would mean reading the entire tenant — both overreach
 * and a different consent conversation.
 *
 * Device code needs neither: the user is shown a short code, approves in a
 * browser on any device, and we receive an access token plus a refresh token.
 * The refresh token is what gets stored; access tokens live about an hour and
 * are minted on demand.
 */
export interface DeviceCodeStartResult {
    deviceCode: string;
    userCode: string;
    verificationUri: string;
    expiresInSeconds: number;
    intervalSeconds: number;
    message?: string;
}
export interface DeviceCodeTokens {
    accessToken: string;
    refreshToken?: string;
    expiresInSeconds: number;
    scope?: string;
    tokenType: string;
}
export interface DeviceCodeConfig {
    deviceCodeUrl: string;
    tokenUrl: string;
    clientId: string;
    scope: string;
}
export declare class DeviceCodeError extends Error {
    readonly code: string;
    readonly description?: string;
    constructor(code: string, description?: string);
}
export declare const startDeviceCode: (config: DeviceCodeConfig, fetchImpl?: typeof fetch) => Promise<DeviceCodeStartResult>;
export interface PollOptions {
    onPending?: (secondsRemaining: number) => void;
    now?: () => number;
    sleep?: (ms: number) => Promise<void>;
}
/**
 * Polls until the user approves, declines, or the code expires.
 *
 * `authorization_pending` is the normal state and must not be treated as an
 * error; `slow_down` requires backing off, and ignoring it gets the request
 * throttled.
 */
export declare const pollForDeviceCodeTokens: (config: DeviceCodeConfig, start: DeviceCodeStartResult, fetchImpl?: typeof fetch, options?: PollOptions) => Promise<DeviceCodeTokens>;
/**
 * Exchanges a stored refresh token for a fresh access token.
 *
 * Microsoft rotates refresh tokens, so the response may carry a new one; a
 * caller that ignores it will find its stored token dead after the old one's
 * sliding window closes.
 */
export declare const refreshAccessToken: (config: Omit<DeviceCodeConfig, "deviceCodeUrl">, refreshToken: string, fetchImpl?: typeof fetch) => Promise<DeviceCodeTokens>;
/** Microsoft identity platform endpoints for a tenant. */
export declare const microsoftEndpoints: (tenantId: string) => {
    deviceCodeUrl: string;
    tokenUrl: string;
};
/**
 * Delegated Graph scopes Codali asks for, matching what okacam's
 * `microsoft-integration-service` already requests. `offline_access` is what
 * yields a refresh token — without it the grant is good for one hour and then
 * gone.
 */
export declare const MICROSOFT_GRAPH_SCOPES: string;
//# sourceMappingURL=DeviceCodeAuth.d.ts.map