export type GoogleCredentialStatus = "valid"
/** Google rejected the client id or secret — sign-in is broken. */
 | "invalid"
/** No credentials are configured for the requested Google client. */
 | "unconfigured"
/** Google could not be reached, or answered something unrecognised. */
 | "unknown";
export type GoogleRedirectUriStatus = "registered"
/** Google's authorize endpoint reported redirect_uri_mismatch. */
 | "mismatched"
/** No redirect URI was probed, or the response couldn't be classified —
 *  never coerced to "registered". */
 | "unknown";
export interface GoogleCredentialCheck {
    status: GoogleCredentialStatus;
    clientId: string | null;
    mismatchedPairs: boolean;
    credentialSource: "active" | "preferred" | "managed" | "user" | "none";
    reason: string | null;
    /** Whether Google recognizes `redirectUri` as registered for `clientId`.
     *  Structurally cannot detect this from the token-exchange probe above —
     *  see `probeGoogleRedirectUri`. */
    redirectUriStatus: GoogleRedirectUriStatus;
    redirectUri: string | null;
    checkedAt: number;
}
export declare function resetGoogleCredentialCheckCache(): void;
/**
 * Ask Google's authorization endpoint whether `redirectUri` is registered for
 * `clientId`, without ever completing a sign-in.
 *
 * The token-exchange probe above (`probeGoogle`) uses a constant fake
 * redirect_uri and so structurally cannot see `redirect_uri_mismatch` — the
 * single most common real Google OAuth failure. Google validates redirect_uri
 * at the authorize step and answers via a 302 `Location`, which this reads
 * with `redirect: "manual"` so the redirect is never followed.
 */
export declare function probeGoogleRedirectUri(clientId: string, redirectUri: string): Promise<{
    status: GoogleRedirectUriStatus;
    detail: string | null;
}>;
export declare function checkGoogleSignInCredential(options?: {
    ttlMs?: number;
    now?: () => number;
    redirectUri?: string;
}): Promise<GoogleCredentialCheck>;
export declare function checkGoogleManagedCredential(options?: {
    redirectUri?: string;
}): Promise<GoogleCredentialCheck>;