/**
 * Credential seeder for the CLEO-owned Google PKCE token
 * (E-CONFIG-AUTH-UNIFY E2a / T9418).
 *
 * Per spec OQ-4 (resolved in the T9418 task brief): CLEO does NOT read
 * gemini-cli's npm package token file directly — sharing a refresh token
 * across two clients causes single-use `refresh_token_reused` race
 * failures. Instead CLEO runs its own Google OAuth PKCE flow against the
 * public gemini-cli desktop client and stores tokens at
 * `${getCleoHome()}/google_oauth.json`.
 *
 * The interactive login flow (browser callback server, code exchange) is
 * deferred to E3's `cleo llm login gemini` command. This seeder ships only
 * the **read + refresh** path the pool needs at load time.
 *
 * ## File path & shape
 *
 * `${getCleoHome()}/google_oauth.json`, chmod 0o600 (writer is the
 * interactive login flow — out of scope here):
 *
 * ```json
 * {
 *   "access_token": "ya29...",
 *   "refresh_token": "1//...",
 *   "expires_at": 1744848000000,   // unix MILLIseconds
 *   "email": "user@example.com"
 * }
 * ```
 *
 * The shape is intentionally flatter than Hermes' "packed refresh" format
 * because CLEO does not need to carry GCP project IDs through the token
 * file — the Gemini transport reads project context from
 * `~/.cleo/config.json` instead. Extra keys (e.g. a stale `project_id`)
 * are tolerated and ignored.
 *
 * ## Refresh-on-expiry
 *
 * When `expires_at` is in the past (or within the 60-second clock-skew
 * buffer), the seeder calls {@link refreshGoogleAccessToken} to mint a
 * fresh access token. **The refreshed token file is NOT written back to
 * disk by this seeder** — the credential store keeps the canonical copy
 * and the interactive login flow (E3) owns disk writes. The seeder simply
 * emits the freshly-refreshed entry so the pool starts the session with a
 * live token.
 *
 * When refresh fails (revoked token, network out, etc.) the seeder emits
 * the stored entry as-is with a warning; the credential pool's mark-bad
 * machinery will quarantine it on the first 401 response.
 *
 * @module llm/credential-seeders/gemini-cli-seeder
 * @task T9418
 * @epic E-CONFIG-AUTH-UNIFY (E2a)
 */
import type { CredentialSeeder, SeederResult } from './index.js';
/**
 * Resolve the CLEO-owned Google OAuth token path.
 *
 * Routed through `getCleoHome()` so the `CLEO_HOME` env override and
 * platform-aware XDG resolution apply uniformly (T9403 / T9405). Exposed
 * for tests.
 *
 * @internal
 * @task T9418
 */
export declare function getGoogleOauthPath(): string;
/**
 * Credential seeder for the CLEO-owned Google PKCE token store.
 *
 * @task T9418
 */
export declare class GeminiCliSeeder implements CredentialSeeder {
    readonly sourceId: "gemini-cli";
    readonly provider = "gemini";
    /**
     * Read `google_oauth.json` and emit a seeded credential entry,
     * refreshing the access token first when it is expired or near expiry.
     *
     * Never throws — every failure path resolves to `{ entries: [], warnings? }`.
     *
     * @returns Zero or one entry plus optional warnings.
     * @task T9418
     */
    seed(): Promise<SeederResult>;
}
/**
 * Module-level singleton registered into `BUILTIN_SEEDERS`.
 *
 * @task T9418
 */
export declare const geminiCliSeeder: CredentialSeeder;
//# sourceMappingURL=gemini-cli-seeder.d.ts.map