/**
 * oauth-flow.ts, the OAuth 2.0 machinery for calendar connectivity: the
 * authorization-code flow with a loopback redirect and mandatory PKCE (the standard
 * native-app pattern, RFC 8252/7636), and the device-code flow (RFC 8628) as the
 * headless fallback. Token exchange, refresh, and revocation live here too.
 *
 * Every network call goes through the injected HttpFetch, this file never imports
 * a real fetch, so the full flow runs against fake servers in tests with no real
 * network and no real port. PKCE hashing/randomness reuse the SDK's runtime-neutral
 * crypto adapter.
 */
import type { AuthCodeFlowStart, DeviceCodeFlowStart, FlowFailureReason, HttpFetch, LoopbackListenerFactory, LoopbackWaiter, ResolvedClientConfig, StoredTokenSet } from './oauth-types.js';
/** A typed flow failure carrying the honest reason a caller surfaces to the user. */
export declare class OAuthFlowError extends Error {
    readonly reason: FlowFailureReason;
    /** The provider status, when the failure came from an HTTP response. */
    readonly status?: number;
    constructor(reason: FlowFailureReason, message: string, status?: number);
}
export interface PkcePair {
    readonly verifier: string;
    readonly challenge: string;
}
/** Create a PKCE verifier + S256 challenge. */
export declare function createPkcePair(): Promise<PkcePair>;
/** Turn a provider token response into a StoredTokenSet, keeping a prior refresh
 *  token when the response omits one (Google omits it on refresh). */
export declare function parseTokenResponse(raw: unknown, now: number, priorRefreshToken?: string): StoredTokenSet;
/**
 * Begin the authorization-code flow: bind a loopback listener, build the PKCE
 * authorization URL, and return both. The caller opens the URL in a browser and
 * awaits waiter.waitForCode(), then calls completeAuthCodeFlow.
 */
export declare function beginAuthCodeFlow(config: ResolvedClientConfig, listenerFactory: LoopbackListenerFactory): Promise<{
    readonly start: AuthCodeFlowStart;
    readonly waiter: LoopbackWaiter;
}>;
/** Exchange an authorization code for tokens (PKCE). */
export declare function completeAuthCodeFlow(config: ResolvedClientConfig, fetchImpl: HttpFetch, input: {
    readonly code: string;
    readonly verifier: string;
    readonly redirectUri: string;
}, now: number): Promise<StoredTokenSet>;
/** Begin the device-code flow: request a device + user code to display. */
export declare function beginDeviceCodeFlow(config: ResolvedClientConfig, fetchImpl: HttpFetch, now: number): Promise<DeviceCodeFlowStart>;
/** Injected delay so device-code polling is deterministic in tests. */
export type Sleep = (ms: number) => Promise<void>;
/**
 * Poll the token endpoint until the user approves the device code, the code expires,
 * or the request is denied. Honors authorization_pending (keep polling) and slow_down
 * (widen the interval) per RFC 8628.
 */
export declare function pollDeviceCodeFlow(config: ResolvedClientConfig, fetchImpl: HttpFetch, start: DeviceCodeFlowStart, clock: () => number, sleep: Sleep): Promise<StoredTokenSet>;
/** Exchange a refresh token for a fresh access token. */
export declare function refreshAccessToken(config: ResolvedClientConfig, fetchImpl: HttpFetch, refreshToken: string, now: number): Promise<StoredTokenSet>;
/**
 * Revoke a token at the provider (Google). Returns true when the provider confirms.
 * When the provider has no revocation endpoint (Microsoft), returns false so the
 * caller knows disconnect is local-only.
 */
export declare function revokeToken(config: ResolvedClientConfig, fetchImpl: HttpFetch, token: string): Promise<boolean>;
//# sourceMappingURL=oauth-flow.d.ts.map