import { Logger } from '../../util/logging.js';
/**
 * Contains the OAuth token endpoint result.
 *
 * `access_token` and `refresh_token` are secrets. Do not log this object.
 */
export interface GetTokenResult {
    /** Access token returned by the federation endpoint. */
    access_token: string;
    /** OAuth token type, normally `Bearer`. */
    token_type: string;
    /** Number of seconds until the access token expires. */
    expires_in: number;
    /** Contains the scope. */
    scope?: string;
    /** Contains the refresh token. */
    refresh_token?: string;
}
/**
 * Starts a loopback callback server and obtains an OAuth authorization code.
 *
 * The function writes the authorization URL, optionally opens it in a browser,
 * and waits until the browser redirects to the local server. `timeoutMs`
 * limits that wait. The returned verifier is secret and is required by
 * {@link getToken}.
 */
export declare function getCode(params: {
    clientId: string;
    authEndpoint: string;
    federationId: string;
    writer?: (s: string) => void;
    noBrowserOpen?: boolean;
    timeoutMs?: number;
    logger?: Logger;
}): Promise<{
    code: string;
    state: string;
    redirectUri: string;
    verifier: string;
}>;
/**
 * Exchanges an authorization code and PKCE verifier for OAuth tokens.
 *
 * The function rejects non-success HTTP responses. Treat the returned access
 * token and optional refresh token as secrets.
 */
export declare function getToken(params: {
    clientId: string;
    tokenEndpoint: string;
    code: string;
    redirectUri: string;
    verifier: string;
    ca?: Buffer | string | string[];
    logger?: Logger;
}): Promise<GetTokenResult>;
/**
 * Completes the interactive OAuth authorization-code flow with PKCE.
 *
 * This combines {@link getCode} and {@link getToken}. `timeoutMs` applies to
 * the wait for the browser callback. Set `noBrowserOpen` to print the URL
 * without launching a browser.
 */
export declare function authorize(params: {
    clientId: string;
    federationEndpoint: string;
    federationId: string;
    writer?: (s: string) => void;
    noBrowserOpen?: boolean;
    timeoutMs?: number;
    ca?: Buffer | string | string[];
    logger?: Logger;
}): Promise<GetTokenResult>;
//# sourceMappingURL=auth.d.ts.map