export interface OAuthConfig {
    clientId: string;
    clientSecret: string;
    redirectUri: string;
}
export declare class OAuthManager {
    private client;
    private defaultScopes;
    constructor(config: OAuthConfig, defaultScopes?: string[]);
    /**
     * @param state Opaque value round-tripped through Google and returned on the callback.
     *   Pass a per-login, unpredictable value (e.g. `signState()` in router.ts) and verify it
     *   on callback — without this, the OAuth flow has no CSRF protection: an attacker can start
     *   their own OAuth transaction, capture the callback, and trick a victim's browser into
     *   completing it (login CSRF / session fixation).
     */
    getAuthUrl(scopes?: string[], state?: string): string;
    getTokens(code: string): Promise<unknown>;
    refreshTokens(refreshToken: string): Promise<unknown>;
    /** Verifies a Google ID token. Only works when `openid` scope was requested (use createLoginOAuthManager). */
    verifyToken(idToken: string): Promise<unknown>;
}
/** Standard adapter-only OAuth — for backend-to-Sheets communication. Does NOT produce id_token. */
export declare function createOAuthManager(config: OAuthConfig): OAuthManager;
/**
 * Login OAuth manager — pre-configured with `openid email profile` scopes alongside
 * Sheets scopes. Use this for user-facing Google Sign-In. The tokens it produces include
 * an `id_token` that can be verified with `manager.verifyToken(idToken)`.
 */
export declare function createLoginOAuthManager(config: OAuthConfig): OAuthManager;
//# sourceMappingURL=oauth.d.ts.map