/**
 * OAuth 2.0 Authorization Code Grant with PKCE
 * RFC 6749 (OAuth 2.0) + RFC 7636 (PKCE)
 *
 * Used for CLI tools that can open a browser and listen on localhost.
 * More secure than device flow for local environments.
 */
export interface AuthCodeFlowConfig {
    clientId: string;
    clientSecret?: string;
    authorizationUrl: string;
    tokenUrl: string;
    scopes?: string[];
    redirectPort?: number;
}
export interface TokenResponse {
    access_token: string;
    refresh_token?: string;
    expires_in: number;
    token_type: string;
    scope?: string;
}
export declare class AuthCodeFlowAuthenticator {
    private config;
    private server?;
    private codeVerifier;
    private codeChallenge;
    private state;
    private redirectUri?;
    constructor(config: AuthCodeFlowConfig);
    /**
     * Complete OAuth Authorization Code Flow with PKCE
     */
    authenticate(): Promise<TokenResponse>;
    /**
     * Generate cryptographically random code verifier
     */
    private generateCodeVerifier;
    /**
     * Generate code challenge from verifier using SHA256
     */
    private generateCodeChallenge;
    /**
     * Generate random state for CSRF protection
     */
    private generateState;
    /**
     * Start temporary HTTP server to receive OAuth callback
     */
    private startCallbackServer;
    /**
     * Stop the callback server
     */
    private stopCallbackServer;
    /**
     * Build authorization URL with PKCE parameters
     */
    private buildAuthorizationUrl;
    /**
     * Display instructions to user
     */
    private displayUserInstructions;
    /**
     * Open browser to authorization URL
     */
    private openBrowser;
    /**
     * Wait for OAuth callback with authorization code
     */
    private waitForCallback;
    /**
     * Exchange authorization code for access token
     */
    private exchangeCodeForToken;
}
//# sourceMappingURL=oauth-auth-code-flow.d.ts.map