/**
 * Auth module — OAuth2 client factory with multi-account support.
 *
 * Reads tokens from the unified store at ~/.go-easy/accounts.json.
 * Falls back to legacy CLI stores (~/.gmcli, ~/.gdcli, ~/.gccli) via migration.
 *
 * Token resolution per account:
 *   1. combined token (if it has the needed scope) → use it
 *   2. per-service token (legacy migration) → use it
 *   3. neither → AUTH_MISSING_SCOPE with fix command
 */
import { OAuth2Client } from 'google-auth-library';
import type { GoogleService } from './auth-store.js';
export type { GoogleService } from './auth-store.js';
/**
 * Get an OAuth2Client for a specific service and account.
 *
 * @param service - Which Google service (determines scope check)
 * @param account - Email address (defaults to first account in the store)
 * @returns Configured OAuth2Client with refresh token set
 * @throws AuthError with specific code and fix command
 *
 * @example
 * ```ts
 * import { getAuth } from '@marcfargas/go-easy/auth';
 * const auth = await getAuth('gmail', 'marc@blegal.eu');
 * ```
 */
export declare function getAuth(service: GoogleService, account?: string): Promise<OAuth2Client>;
/**
 * List available accounts (emails) for a service.
 * Only returns accounts that have a token for the given service.
 */
export declare function listAccounts(service: GoogleService): Promise<string[]>;
/**
 * List all accounts regardless of service.
 */
export declare function listAllAccounts(): Promise<Array<{
    email: string;
    scopes: string[];
    source: string;
}>>;
/**
 * Clear the client cache. Useful for tests or token rotation.
 */
export declare function clearAuthCache(): void;
//# sourceMappingURL=auth.d.ts.map