/**
 * Drives the Google Auth Platform console
 * (console.cloud.google.com/auth/audience and .../auth/clients) for the three
 * things the OAuth setup path needs a browser for: reading and changing the
 * publishing status, and creating the Desktop app OAuth client.
 *
 * The publishing-status flows exist because of one verified fact (see
 * google-setup-plan.ts's header comment): an OAuth app left in "Testing"
 * issues refresh tokens that expire after seven days. `publishApp` never
 * reports success from having clicked "PUBLISH APP", it re-reads the status
 * afterward and only reports success once the re-read confirms the change
 * actually took.
 *
 * The OAuth client's secret is a credential and is returned only in the
 * dedicated `clientSecret` field of the `ok` result, never in `detail`,
 * `problem`, or `fix`.
 */
import type { GoogleBrowserPort } from './types.js';
export type PublishingStatus = 'testing' | 'in-production' | 'unknown';
export type ConsoleReason = 'sign-in-required' | 'project-not-selected' | 'status-not-found' | 'publish-button-not-found' | 'confirm-dialog-not-found' | 'publish-did-not-take' | 'publish-status-unreadable' | 'client-already-exists' | 'create-client-button-not-found' | 'application-type-not-found' | 'name-field-not-found' | 'create-button-not-found' | 'credentials-not-readable';
export interface ConsoleNeedsHuman {
    readonly kind: 'needs-human';
    readonly reason: ConsoleReason;
    readonly problem: string;
    readonly fix: string;
}
export interface ConsoleFailed {
    readonly kind: 'failed';
    readonly reason: ConsoleReason;
    readonly problem: string;
    readonly fix: string;
}
export interface ReadPublishingStatusOk {
    readonly kind: 'ok';
    readonly detail: string;
    readonly status: PublishingStatus;
}
export type ReadPublishingStatusResult = ReadPublishingStatusOk | ConsoleNeedsHuman | ConsoleFailed;
export interface PublishAppOk {
    readonly kind: 'ok';
    readonly detail: string;
    readonly status: 'in-production';
}
export type PublishAppResult = PublishAppOk | ConsoleNeedsHuman | ConsoleFailed;
export interface CreateDesktopOAuthClientOptions {
    readonly name: string;
}
export interface CreateOAuthClientOk {
    readonly kind: 'ok';
    readonly detail: string;
    readonly clientId: string;
    readonly clientSecret: string;
}
export type CreateDesktopOAuthClientResult = CreateOAuthClientOk | ConsoleNeedsHuman | ConsoleFailed;
export interface ReadPublishingStatusOptions {
    /**
     * Overrides the page navigated to. Defaults to the real Google Auth
     * Platform audience page. The only legitimate reason to override it is a
     * test driving this flow's real logic against a local fake page instead of
     * a live Google Cloud project, production callers never set this.
     */
    readonly pageUrl?: string;
}
/**
 * Reads the current publishing status from the audience page. Distinguishes
 * "not signed in" and "no project selected" from a genuine read failure.
 */
export declare function readPublishingStatus(browser: GoogleBrowserPort, options?: ReadPublishingStatusOptions): Promise<ReadPublishingStatusResult>;
/**
 * Clicks "PUBLISH APP", confirms the dialog, then re-reads the status to
 * verify it actually changed. Success is reported only from the re-read,
 * never from having clicked.
 */
export declare function publishApp(browser: GoogleBrowserPort, options?: ReadPublishingStatusOptions): Promise<PublishAppResult>;
/**
 * Creates a Desktop app OAuth client named `options.name`. Detects a client
 * with that name already existing on the clients page and reports it as
 * `needs-human` instead of creating a duplicate.
 */
export declare function createDesktopOAuthClient(browser: GoogleBrowserPort, options: CreateDesktopOAuthClientOptions): Promise<CreateDesktopOAuthClientResult>;
//# sourceMappingURL=console-flow.d.ts.map