/**
 * Drives Google's app-password page (https://myaccount.google.com/apppasswords)
 * to create a 16-character app password with a known label.
 *
 * Three states are not "ready" and are detected and returned distinctly
 * instead of retried in a loop:
 *
 *  - `sign-in-required` , Google redirected to a sign-in page.
 *  - `two-step-required`, the account has no 2-Step Verification, so Google
 *                           makes app passwords unavailable outright.
 *  - `label-already-exists`, an app password with this label is already
 *                              listed. Google never re-displays an existing
 *                              password, so the only way forward is reusing
 *                              the one already stored, or deleting that entry
 *                              and re-running. Detecting this is what makes
 *                              the flow idempotent instead of piling up
 *                              duplicate app passwords on every re-run.
 *
 * The created password is returned only in the dedicated `password` field of
 * the `ok` result. It is never written into `detail`, `problem`, or `fix`,
 * those are the strings that get logged and shown in error messages.
 */
import { findElement } from './browser-elements.js';
import type { GoogleBrowserPort } from './types.js';
export type AppPasswordReason = 'sign-in-required' | 'two-step-required' | 'label-already-exists' | 'create-form-not-found' | 'result-dialog-not-found';
export interface AppPasswordOk {
    readonly kind: 'ok';
    readonly detail: string;
    readonly password: string;
}
export interface AppPasswordNeedsHuman {
    readonly kind: 'needs-human';
    readonly reason: AppPasswordReason;
    readonly problem: string;
    readonly fix: string;
}
export interface AppPasswordFailed {
    readonly kind: 'failed';
    readonly reason: AppPasswordReason;
    readonly problem: string;
    readonly fix: string;
}
export type CreateAppPasswordResult = AppPasswordOk | AppPasswordNeedsHuman | AppPasswordFailed;
export interface CreateAppPasswordOptions {
    readonly label?: string;
    /**
     * Overrides the page navigated to. Defaults to Google's real app-password
     * page. The only legitimate reason to override it is a test driving this
     * flow's real logic against a local fake page instead of a live Google
     * account, production callers never set this.
     */
    readonly pageUrl?: string;
}
/**
 * Creates a Google app password under `label` (default: `APP_PASSWORD_LABEL`).
 * Never throws for any of the three known non-ready states; each is reported
 * as a typed `needs-human` result instead.
 */
export declare function createAppPassword(browser: GoogleBrowserPort, options?: CreateAppPasswordOptions): Promise<CreateAppPasswordResult>;
export { findElement };
//# sourceMappingURL=app-password-flow.d.ts.map