/**
 * connection-repair.ts, finishing an adoption that only half landed.
 *
 * The owner ran `/google adopt`. It reported success. The secret half went into
 * the store; the config half, the OAuth client id, and the reference naming
 * where its secret lives, did not reach anywhere the daemon reads, because the
 * `calendar` config section did not exist to write into outside the one product
 * that carried a seeder for it. The result is a machine holding half a
 * credential, which reports "no Google account connected" exactly as loudly as
 * holding none, and a person who was told the setup worked.
 *
 * Moving stored credentials between tiers cannot fix that: there is nothing in
 * any tier to move. What DOES fix it is the thing the adoption already does,
 * run again, and the files it reads are still on the machine, untouched,
 * because adoption never writes them.
 *
 * ── The boundary, and why it is where it is ─────────────────────────────────
 *
 * This does NOT adopt credentials on someone's behalf. It runs only when the
 * secret store already holds a Google credential, which is to say only when
 * someone already ran an adoption or a setup on this machine and it half
 * landed. Finishing what a person started is repair. Starting it for them
 * would be the daemon deciding on its own to take up credentials belonging to
 * another tool, and that is not this function's call to make.
 *
 * It is also idempotent and cheap: a connection whose config half is present
 * returns `already-connected` after two config reads and one secret read.
 */
import type { GoogleConfigPort, GoogleSecretPort } from './types.js';
import type { GoogleFilePort } from './credential-adoption.js';
/** What the repair found, and what it did about it. */
export type GoogleConnectionRepairOutcome = 
/** Both halves were already present. Nothing was written. */
'already-connected'
/** No Google credential exists on this machine at all. Not this function's job. */
 | 'nothing-to-repair'
/** A credential was present with no config half, and the config half was written. */
 | 'repaired'
/** A credential was present with no config half, and no adoptable source remained. */
 | 'source-gone';
export interface GoogleConnectionRepairResult {
    readonly outcome: GoogleConnectionRepairOutcome;
    /** Safe to display and to log: provenance and state only, never a value. */
    readonly detail: string;
}
/**
 * Complete a Google connection whose config half never landed.
 *
 * Every value that moves goes through the ordinary adoption path, so it is
 * routed and scoped by the same rules any other write is, this adds no second
 * way to store a credential.
 */
export declare function repairHalfLandedGoogleConnection(deps: {
    readonly files: GoogleFilePort;
    readonly config: GoogleConfigPort;
    readonly secrets: GoogleSecretPort;
    readonly homeDirectory: string;
}): Promise<GoogleConnectionRepairResult>;
//# sourceMappingURL=connection-repair.d.ts.map