export interface OAuthConfig {
    clientId: string;
    clientSecret: string;
    redirectUri: string;
}
/** Default scopes for `createLoginOAuthManager()` / `createAuthRouter()`. Exported so a
 *  caller overriding `AuthRouterOptions.scopes` can extend rather than fully replace it,
 *  e.g. `[...LOGIN_SCOPES, 'https://www.googleapis.com/auth/calendar.readonly']`. */
export declare const LOGIN_SCOPES: string[];
export declare class OAuthManager {
    private client;
    private defaultScopes;
    private redirectUri;
    constructor(config: OAuthConfig, defaultScopes?: string[]);
    /** The configured redirect URI. Lets a caller (e.g. the CLI's loopback OAuth capture) inspect
     *  where Google will send the browser back to without needing to keep its own copy of `config`. */
    getRedirectUri(): string;
    /**
     * @param state Opaque value round-tripped through Google and returned on the callback.
     *   Pass a per-login, unpredictable value (e.g. `signState()` in router.ts) and verify it
     *   on callback — without this, the OAuth flow has no CSRF protection: an attacker can start
     *   their own OAuth transaction, capture the callback, and trick a victim's browser into
     *   completing it (login CSRF / session fixation).
     */
    getAuthUrl(scopes?: string[], state?: string): string;
    getTokens(code: string): Promise<unknown>;
    refreshTokens(refreshToken: string): Promise<unknown>;
    /** Verifies a Google ID token. Only works when `openid` scope was requested (use createLoginOAuthManager). */
    verifyToken(idToken: string): Promise<unknown>;
}
/** Standard adapter-only OAuth — for backend-to-Sheets communication. Does NOT produce id_token. */
export declare function createOAuthManager(config: OAuthConfig): OAuthManager;
/**
 * Login OAuth manager — pre-configured with `openid email profile` scopes alongside
 * Sheets scopes. Use this for user-facing Google Sign-In. The tokens it produces include
 * an `id_token` that can be verified with `manager.verifyToken(idToken)`.
 */
export declare function createLoginOAuthManager(config: OAuthConfig): OAuthManager;
//# sourceMappingURL=oauth.d.ts.map