export interface PendingOAuth {
    state: string;
    verifier: string;
    createdAt: number;
    /** The redirect_uri the consent URL carried. Google compares the exchange's
     *  redirect_uri byte-for-byte against it, and since Task 1799 the port is
     *  whatever the loopback listener bound, so the constant can no longer be
     *  assumed.
     *
     *  Optional because an entry written before 1799 carries no such field and
     *  may still be mid-flight across an upgrade; readers fall back to the fixed
     *  loopback constant for those. */
    redirectUri?: string;
}
export declare class PendingStore {
    readonly accountId: string;
    readonly accountsDir: string;
    private key;
    private readonly secretsDir;
    readonly pendingPath: string;
    private readonly keyPath;
    constructor(accountId: string, accountsDir: string);
    /** Shares the account-level AES key with TokenStore. */
    private loadKey;
    write(p: PendingOAuth): void;
    read(): PendingOAuth | null;
    clear(): void;
    /** Seconds since the pending entry was written, or null when none exists.
     *  Clamped at 0: a just-written file's mtimeMs can sit a fraction of a
     *  millisecond ahead of Date.now(), and Math.floor would turn that into -1,
     *  which would then be reported as a negative age by the stranded audit. */
    ageSec(): number | null;
}
//# sourceMappingURL=pending-store.d.ts.map