/**
 * OAuth2 PKCE utilities for the MCP server integration.
 *
 * Implements the Authorization Code + PKCE flow as specified in RFC 7636.
 * All HTTPS requests use the default TLS verification — rejectUnauthorized
 * is never set to false.
 */
import type { OAuthConfig, TokenResult, PKCEPair } from './types.js';
/**
 * Generates a PKCE code verifier and its S256 code challenge.
 * codeVerifier: 32 random bytes as base64url = 43 characters (RFC 7636 minimum).
 */
export declare function generatePKCE(): PKCEPair;
/**
 * Constructs the OAuth2 authorization URL with all required query parameters.
 */
export declare function buildAuthUrl(config: OAuthConfig, state: string, codeChallenge?: string): string;
/**
 * Exchanges an authorization code for tokens at the token endpoint.
 * Throws AuthError(OAUTH_CODE_EXCHANGE_FAILED) on non-2xx responses.
 */
export declare function exchangeCode(config: OAuthConfig, code: string, codeVerifier?: string): Promise<TokenResult>;
/**
 * Exchanges a refresh token for a new token set at the token endpoint.
 * Throws AuthError(TOKEN_REFRESH_FAILED) on non-2xx responses.
 */
export declare function refreshToken(config: OAuthConfig, currentRefreshToken: string): Promise<TokenResult>;
/**
 * Starts a local HTTP server on 127.0.0.1 to receive the OAuth2 callback.
 * Resolves with { code, state } on success.
 * Rejects with AuthError on OAuth error, state mismatch, port conflict, or timeout.
 * The server is closed after handling the first request or on timeout.
 * The authorization code is never logged.
 */
export declare function startCallbackServer(port: number, expectedState: string, timeoutMs?: number): Promise<{
    code: string;
    state: string;
}>;
/**
 * Opens the given URL in the default system browser.
 * Fire-and-forget — errors are silently ignored.
 */
export declare function openBrowser(url: string): void;
//# sourceMappingURL=oauth.d.ts.map