export interface GoogleOAuthCredentials {
    clientId: string;
    clientSecret: string;
}
export interface GoogleOAuthCredentialKeyPair {
    clientIdKey: string;
    clientSecretKey: string;
}
export type ReadGoogleOAuthCredential = (key: string) => string | null | undefined | Promise<string | null | undefined>;
export declare const GOOGLE_PRIMARY_PROVIDER_CREDENTIAL_KEYS: {
    readonly clientIdKey: "GOOGLE_CLIENT_ID";
    readonly clientSecretKey: "GOOGLE_CLIENT_SECRET";
};
export declare const GOOGLE_LEGACY_PROVIDER_CREDENTIAL_KEYS: {
    readonly clientIdKey: "GOOGLE_LEGACY_CLIENT_ID";
    readonly clientSecretKey: "GOOGLE_LEGACY_CLIENT_SECRET";
};
export declare const GOOGLE_PROVIDER_CREDENTIAL_KEY_PAIRS: readonly [{
    readonly clientIdKey: "GOOGLE_CLIENT_ID";
    readonly clientSecretKey: "GOOGLE_CLIENT_SECRET";
}, {
    readonly clientIdKey: "GOOGLE_LEGACY_CLIENT_ID";
    readonly clientSecretKey: "GOOGLE_LEGACY_CLIENT_SECRET";
}];
export declare function resolveGoogleProviderCredentialCandidatesWithReader(options: {
    readCredential: ReadGoogleOAuthCredential;
    fallbackReadCredential?: ReadGoogleOAuthCredential;
    credentialKeyPairs?: readonly GoogleOAuthCredentialKeyPair[];
}): Promise<GoogleOAuthCredentials[]>;
export declare function resolveGoogleSignInCredentials(): GoogleOAuthCredentials | null;
export declare function hasGoogleSignInCredentials(): boolean;
/**
 * Record the pair Better Auth actually handed to the Google provider.
 *
 * The effective pair is not always the preferred one: a template asking for
 * broader scopes is wired to GOOGLE_CLIENT_ID/SECRET instead. Anything testing
 * "the credential the callback will use" must read this rather than
 * re-deriving it, or it will verify a pair nothing reads and report healthy.
 */
export declare function recordActiveGoogleSignInCredentials(credentials: GoogleOAuthCredentials | null): void;
export declare function resetActiveGoogleSignInCredentials(): void;
export declare function getActiveGoogleSignInCredentials(): {
    credentials: GoogleOAuthCredentials | null;
    recorded: boolean;
    version: number;
};
/**
 * Which sign-in credential pairs are configured, and whether they disagree.
 *
 * `mismatched` is diagnostic only. Two pairs may name different clients when
 * identity sign-in and provider APIs intentionally have separate OAuth apps.
 * Callers must compare the pair used by their specific flow, not delete one
 * based on this flag alone.
 */
export declare function describeGoogleSignInCredentialPairs(): {
    signInClientId: string | null;
    providerClientId: string | null;
    mismatched: boolean;
};
export declare function resolveGoogleProviderCredentials(): GoogleOAuthCredentials | null;
export declare function resolveGoogleLegacyProviderCredentials(): GoogleOAuthCredentials | null;
export declare function resolveGoogleProviderCredentialCandidates(): GoogleOAuthCredentials[];