/**
 * OAuth 2.0 Authorization Code + PKCE flow for Microsoft Identity Platform.
 *
 * Adapted from nsakki55/outlook-mcp@e49d8e68ac8d69db653c25803127dc3b98626cda
 * (MIT). Adaptations:
 *   - Ephemeral loopback port via `server.listen(0)` (upstream uses fixed
 *     49152). The Entra app is registered with `http://localhost` (no port);
 *     Microsoft Identity Platform treats native-app loopback redirects with
 *     port-flexible matching.
 *   - No `xdg-open` browser auto-launch; the auth URL is logged to stderr
 *     and returned to the caller for the operator to open in the VNC browser.
 *   - Tool handler awaits the full PKCE flow synchronously (5-min timeout)
 *     instead of upstream's background-promise + immediate-error pattern.
 */
export interface PkceFlowConfig {
    clientId: string;
    tenantId: string;
    accountId: string;
}
export interface TokenResponse {
    access_token: string;
    refresh_token?: string;
    expires_in: number;
    token_type: string;
    scope?: string;
}
export interface PkceFlowResult {
    tokenResponse: TokenResponse;
    scopes: string[];
}
export interface PkceFlowStart {
    authUrl: string;
    redirectUri: string;
    result: Promise<PkceFlowResult>;
}
/**
 * Start the PKCE flow:
 *   1. Generate code_verifier + code_challenge (S256) + state.
 *   2. Bind a one-shot HTTP server on an ephemeral loopback port.
 *   3. Build the authorize URL with the actual port; return it to the caller.
 *   4. The returned `result` promise resolves when the callback arrives (or
 *      rejects on state mismatch / OAuth error / timeout) and tokens are
 *      exchanged.
 *
 * The caller (the outlook-account-register tool) prints the auth URL,
 * returns it in the tool response, and awaits `result`.
 */
export declare function startPkceFlow(config: PkceFlowConfig): Promise<PkceFlowStart>;
export declare function refreshAccessToken(args: {
    clientId: string;
    tenantId: string;
    refreshToken: string;
}): Promise<TokenResponse>;
/**
 * Constant-time equality on equal-length strings. Returns false (not throws)
 * for length mismatch so the caller can branch without leaking length via
 * timing. State comparison MUST go through this helper, not `!==`.
 */
declare function sameLengthEqual(a: string, b: string): boolean;
export declare const _internals: {
    SCOPES: string[];
    sameLengthEqual: typeof sameLengthEqual;
};
export {};
//# sourceMappingURL=pkce-flow.d.ts.map