/** A PKCE (S256) pair: the server keeps the challenge, only this process ever holds the verifier. */
export declare function createPkcePair(): {
    codeVerifier: string;
    codeChallenge: string;
};
export type ApprovalCallback = {
    port: number;
    approvalCode: Promise<string>;
    close: () => void;
};
/**
 * Listens on a random loopback port for the browser that approves the login. The dashboard
 * redirects only that browser to `http://127.0.0.1:<port>/callback?approval_code=...`, so the
 * approval code reaches this machine and never the party that started the login elsewhere.
 */
export declare function listenForApprovalCallback(returnMessage: string): Promise<ApprovalCallback>;
export declare class LoginTimedOutError extends Error {
}
export declare function waitForApprovalCode(callback: ApprovalCallback, timeoutMs: number, timeoutMessage: string): Promise<string>;