/**
 * oauth-providers.ts, the fixed provider profiles for Google Calendar and
 * Microsoft Outlook (Graph), plus client-config resolution.
 *
 * Bring your own OAuth app. No first-party client id ships with the product: the
 * person setting up a GoodVibes environment registers the provider app themselves
 * and sets its client id in config. A profile therefore carries the ENDPOINTS and
 * the NAMES OF THE CONFIG KEYS the credentials are read from, and no credential of
 * its own.
 *
 * This replaces an earlier design that carried a "bundled project client id"
 * shipping as a literal placeholder string, on the plan that real ids would be
 * dropped into config defaults later. They will not be. A baked default is exactly
 * what an operator cannot audit or rotate, and a placeholder that reaches a provider
 * produces a failure that reads like a broken build rather than an unfinished setup.
 * `resolveClientConfig` reports `isConfigured: false` when no id is set, and flows
 * refuse with `client-not-configured` naming the key to set.
 *
 * A desktop / public-client registration needs no client secret when paired with
 * PKCE (RFC 8252/7636), which is the recommended registration for both providers;
 * an operator who registers a confidential client supplies a secret as well.
 */
import type { CalendarProviderId, OAuthClientOverrides, OAuthProviderProfile, ResolvedClientConfig } from './oauth-types.js';
/** Google Calendar read scope and read/write events scope. Read-write is the default
 *  so event creation works; a user may narrow to read-only via overrides. */
export declare const GOOGLE_SCOPES_DEFAULT: readonly ["https://www.googleapis.com/auth/calendar.readonly", "https://www.googleapis.com/auth/calendar.events"];
/** Microsoft Graph read/write calendar scope (+ offline_access for a refresh token). */
export declare const MICROSOFT_SCOPES_DEFAULT: readonly ["offline_access", "Calendars.ReadWrite"];
export declare const GOOGLE_PROFILE: OAuthProviderProfile;
export declare const MICROSOFT_PROFILE: OAuthProviderProfile;
/** Look up a provider profile. */
export declare function providerProfile(provider: CalendarProviderId): OAuthProviderProfile;
/**
 * Merge a profile with the operator's supplied credentials into the config a flow
 * runs with.
 *
 * Resolving is total: it never throws and never invents an id. With no client id
 * supplied the result carries the empty string and `isConfigured: false`, so a
 * caller can ASK about the state, render "not connected, set this key", without
 * having to catch an exception. Refusing is the flow's job, not the resolver's
 * (see `assertClientConfigured` in oauth-flow.ts).
 */
export declare function resolveClientConfig(profile: OAuthProviderProfile, overrides?: OAuthClientOverrides): ResolvedClientConfig;
/**
 * The exact provider-console steps whoever is setting up this GoodVibes
 * environment follows to register their own OAuth app.
 *
 * These are not "advanced" steps any more, they are THE setup, because no client
 * id ships with the product. Surfaced verbatim by the connect flow's refusal help
 * and copied into docs/calendar-oauth-setup.md. Kept as data so the surfaces and
 * the docs never drift.
 */
export declare const PROVIDER_SETUP_STEPS: Readonly<Record<CalendarProviderId, readonly string[]>>;
//# sourceMappingURL=oauth-providers.d.ts.map