/**
 * Ephemeral-port localhost callback server for the browser-based OAuth flow
 * (ADR-306). A minimal single-request HTTP server — deliberately not a full
 * framework for one GET route that lives for one request and then shuts
 * down. A TypeScript port of meta-proxy's `src/oauth/callback_server.rs`.
 *
 * @module v3/security/oauth/callback-server
 */
export interface CallbackResult {
    code: string | null;
    state: string | null;
    error: string | null;
}
export declare class CallbackTimeoutError extends Error {
    constructor();
}
export declare class CallbackServer {
    private readonly server;
    readonly redirectUri: string;
    readonly port: number;
    private constructor();
    /**
     * Binds `127.0.0.1:0` (OS-assigned ephemeral port) and returns the server
     * plus the exact `redirect_uri` to send in the authorize request — must be
     * the `http://127.0.0.1:<port>/oauth/callback` shape identity's
     * `validate_redirect_uri` accepts.
     */
    static bind(): Promise<CallbackServer>;
    /**
     * Waits for exactly one `GET /oauth/callback?...` request, replies with the
     * browser success page, closes the server, and returns the parsed query
     * parameters. Times out after `waitForMs` so a login attempt the user
     * abandons in the browser doesn't hang the CLI forever.
     */
    awaitCallback(waitForMs?: number): Promise<CallbackResult>;
}
//# sourceMappingURL=callback-server.d.ts.map