export interface GoogleOAuthCredentials {
    clientId: string;
    clientSecret: string;
}
export interface GoogleOAuthCredentialKeyPair {
    clientIdKey: string;
    clientSecretKey: string;
}
export type ReadGoogleOAuthCredential = (key: string) => string | null | undefined | Promise<string | null | undefined>;
export declare const GOOGLE_PRIMARY_PROVIDER_CREDENTIAL_KEYS: {
    readonly clientIdKey: "GOOGLE_CLIENT_ID";
    readonly clientSecretKey: "GOOGLE_CLIENT_SECRET";
};
export declare const GOOGLE_LEGACY_PROVIDER_CREDENTIAL_KEYS: {
    readonly clientIdKey: "GOOGLE_LEGACY_CLIENT_ID";
    readonly clientSecretKey: "GOOGLE_LEGACY_CLIENT_SECRET";
};
export declare const GOOGLE_PROVIDER_CREDENTIAL_KEY_PAIRS: readonly [{
    readonly clientIdKey: "GOOGLE_CLIENT_ID";
    readonly clientSecretKey: "GOOGLE_CLIENT_SECRET";
}, {
    readonly clientIdKey: "GOOGLE_LEGACY_CLIENT_ID";
    readonly clientSecretKey: "GOOGLE_LEGACY_CLIENT_SECRET";
}];
/**
 * Resolve Google provider credentials from an app-owned credential source.
 *
 * Templates pass their scoped secret reader so Core does not choose an app's
 * secret store or request context. An optional fallback reader preserves
 * deployments that still keep the same credential pair in environment vars.
 * Each candidate pair is read atomically and de-duped by client id, which lets
 * refresh paths retry tokens minted by a previous Google OAuth client without
 * ever mixing an id and secret from different sources.
 */
export declare function resolveGoogleProviderCredentialCandidatesWithReader(options: {
    readCredential: ReadGoogleOAuthCredential;
    fallbackReadCredential?: ReadGoogleOAuthCredential;
    credentialKeyPairs?: readonly GoogleOAuthCredentialKeyPair[];
}): Promise<GoogleOAuthCredentials[]>;
/**
 * Credentials for identity-only Google sign-in. Deploys that also use Google
 * product APIs can set these separately from GOOGLE_CLIENT_ID/SECRET, which
 * remain the backwards-compatible provider OAuth credentials.
 */
export declare function resolveGoogleSignInCredentials(): GoogleOAuthCredentials | null;
export declare function hasGoogleSignInCredentials(): boolean;
export declare function resolveGoogleProviderCredentials(): GoogleOAuthCredentials | null;
export declare function resolveGoogleLegacyProviderCredentials(): GoogleOAuthCredentials | null;
export declare function resolveGoogleProviderCredentialCandidates(): GoogleOAuthCredentials[];
//# sourceMappingURL=google-oauth-credentials.d.ts.map