/**
 * Getting OAuth client credentials into the agent, the pluggable front step.
 *
 * This module exists to draw one line: **everything downstream of it neither
 * knows nor cares where the client credentials came from.** Consent, refresh
 * token capture, automatic refresh, secret storage, the connector and its
 * capability registration are written once and take a
 * `GoogleClientCredentials` value.
 *
 * Three routes converge here:
 *
 *   1. `console-walkthrough`, the browser drives the user's own Google
 *      account through project → APIs → consent screen → Desktop client.
 *      This is the only UI-dependent, brittle part of the whole integration,
 *      and it is deliberately quarantined behind this boundary: a Google
 *      console redesign breaks the walkthrough and nothing else.
 *   2. `client-json-file`, point at a client JSON from any source. A user
 *      who already has one skips the walkthrough entirely. This is also how
 *      credentials from an existing local tool are adopted; that is not a
 *      special case, it is just this route.
 *   3. `manual-entry`, paste a client id and secret.
 *
 * Because routes 2 and 3 need no browser, the connector can be tested end to
 * end without ever launching one.
 *
 * There is no bundled client credential. Every user's OAuth client belongs to
 * their own Google account, so nothing about any particular account is
 * compiled into the product.
 */
/** OAuth client credentials for an installed ("Desktop app") client. */
export interface GoogleClientCredentials {
    readonly clientId: string;
    readonly clientSecret: string;
    readonly authUri: string;
    readonly tokenUri: string;
}
/** Which route supplied the credentials. Recorded for display, never behaviour. */
export type GoogleClientIntakeRoute = 'console-walkthrough' | 'client-json-file' | 'manual-entry';
export type GoogleClientIntakeResult = {
    readonly ok: true;
    readonly credentials: GoogleClientCredentials;
    readonly route: GoogleClientIntakeRoute;
} | {
    readonly ok: false;
    readonly problem: string;
    readonly fix: string;
};
/**
 * Route 2, parse a downloaded client JSON.
 *
 * Google wraps the credentials in `installed` for Desktop clients and `web`
 * for web clients; some tools store them unwrapped. All three are accepted,
 * but a `web` client is rejected with a specific message, because a web client
 * cannot complete the loopback flow and the resulting failure is otherwise
 * baffling.
 */
export declare function readClientCredentialsFromJson(rawText: string): GoogleClientIntakeResult;
/** Route 3, a client id and secret typed or pasted in directly. */
export declare function clientCredentialsFromInput(input: {
    readonly clientId: string;
    readonly clientSecret: string;
}): GoogleClientIntakeResult;
/**
 * Legacy credential locations that predate the encrypted store.
 *
 * These files hold a refresh token in cleartext on disk, which is the worst
 * property of the setup they came from. Migration reads them exactly once,
 * copies what it finds into the encrypted secret store, and records that it
 * has done so; afterwards nothing reads them again.
 *
 * The files are deliberately **left in place and unmodified**. Another tool
 * may still be using them, and deleting a working credential out from under
 * a running program is not this code's decision to make.
 */
export interface LegacyCredentialLocation {
    readonly label: string;
    readonly clientFile: string;
    readonly tokenFiles: readonly string[];
}
/** Marker recording that migration already ran, so it is not repeated. */
export declare const LEGACY_MIGRATION_CONFIG_KEY = "google.credentials.migratedFrom";
export interface LegacyMigrationOutcome {
    readonly migrated: boolean;
    /** Safe to display: what was moved, never a value. */
    readonly detail: string;
    readonly route: GoogleClientIntakeRoute | null;
}
/**
 * Decide whether a legacy migration should run.
 *
 * Kept as a pure decision so the policy is testable without touching a real
 * home directory or a real secret store.
 */
export declare function shouldMigrateLegacyCredentials(input: {
    readonly alreadyMigratedFrom: string | null;
    readonly legacyFilePresent: boolean;
    readonly storeAlreadyHasCredentials: boolean;
}): {
    readonly migrate: boolean;
    readonly reason: string;
};
//# sourceMappingURL=client-intake.d.ts.map