/**
 * `login "oauth-code"` engine: authorization-code grant (optionally PKCE)
 * through the configured callback transport, followed by the declared token
 * exchange, credential projection, userinfo enrichment and after-exchange hook.
 */
import type { CompiledAuthProvider, CompiledCallback, CompiledOAuthCodeLogin } from "@oh-my-pi/pi-catalog/compat/types";
import { OAuthCallbackFlow, type OAuthCallbackFlowOptions } from "../oauth/callback-server.js";
import type { OAuthController, OAuthCredentials } from "../oauth/types.js";
/**
 * Callback-server options for a rule. A `redirect-uri-env` override is
 * advertised verbatim with random-port fallback disabled; HTTP loopback
 * overrides also bind the listener to the URI's host/port/path.
 */
export declare function resolveCallbackOptions(callback: CompiledCallback, provider: string, signal?: AbortSignal): Promise<OAuthCallbackFlowOptions>;
/** Generic authorization-code flow driven by one compiled rule. */
export declare class DeclarativeOAuthCodeFlow extends OAuthCallbackFlow {
    #private;
    constructor(ctrl: OAuthController, rule: CompiledOAuthCodeLogin, policy: CompiledAuthProvider, options: OAuthCallbackFlowOptions);
    generateState(): string;
    generateAuthUrl(state: string, redirectUri: string): Promise<{
        url: string;
        instructions?: string;
    }>;
    exchangeToken(code: string, state: string, redirectUri: string): Promise<OAuthCredentials>;
}
/** Builds the login function for one `login "oauth-code"` rule. */
export declare function createOAuthCodeLogin(rule: CompiledOAuthCodeLogin, policy: CompiledAuthProvider): (ctrl: OAuthController) => Promise<OAuthCredentials>;