/**
 * Finding Google credentials that already exist on this machine.
 *
 * The defect this exists to fix: working Gmail OAuth credentials were sitting
 * in `~/.gmail-mcp/` while the agent told its owner that email was not
 * configured, because nothing ever looked there. Capability discovery
 * reported empty registries and the model reasoned from that emptiness.
 *
 * So adoption is deliberately generous about where it looks and deliberately
 * strict about what it does with what it finds:
 *
 *   - Adopted files are **read, never written**. They belong to another tool
 *     that is in active use; rotating or rewriting them would break it.
 *   - Secret values never leave this module except through the returned
 *     credential record. Summaries, logs, errors and progress lines carry only
 *     presence, provenance, scopes and expiry, never a token.
 *
 * Precedence is native-first: once the agent has its own credentials in the
 * encrypted store, those win, and the adopted copy becomes a fallback.
 */
/** Where a credential came from. Safe to display. */
export type GoogleCredentialOrigin = 
/** The agent's own encrypted secret store. */
'secret-store'
/** Adopted read-only from a gmail-mcp installation. */
 | 'gmail-mcp';
/** Minimal file access, injected so adoption is testable without a real home directory. */
export interface GoogleFilePort {
    exists(path: string): boolean;
    readText(path: string): string | null;
}
/** A complete, usable OAuth credential set. Contains secrets, never log this. */
export interface GoogleOAuthCredentials {
    readonly clientId: string;
    readonly clientSecret: string;
    readonly refreshToken: string;
    readonly accessToken: string | null;
    /** Epoch milliseconds when the access token expires, when known. */
    readonly expiresAtMs: number | null;
    readonly scopes: readonly string[];
    readonly tokenUri: string;
    readonly origin: GoogleCredentialOrigin;
    /** Where it was found. A path or a store key name, never a value. */
    readonly location: string;
}
/**
 * The safe-to-display view. Everything in here can go in a log line, a status
 * panel, a transcript or an error message.
 */
export interface GoogleCredentialSummary {
    readonly found: boolean;
    readonly origin: GoogleCredentialOrigin | null;
    readonly location: string | null;
    readonly scopes: readonly string[];
    readonly hasRefreshToken: boolean;
    readonly hasAccessToken: boolean;
    /** True when an access token exists but is past (or within a minute of) expiry. */
    readonly accessTokenExpired: boolean;
    /** Capabilities the granted scopes actually permit. */
    readonly canSendMail: boolean;
    readonly canReadMail: boolean;
    readonly canReadCalendar: boolean;
    readonly canWriteCalendar: boolean;
    readonly detail: string;
}
/** Standard locations a gmail-mcp install keeps its files in. */
export interface GmailMcpLayout {
    readonly clientFile: string;
    readonly tokenFiles: readonly string[];
}
/** Build the gmail-mcp paths under an explicit home directory. */
export declare function gmailMcpLayout(homeDirectory: string): GmailMcpLayout;
/**
 * Look for an adoptable credential set in a gmail-mcp installation.
 * Returns null when nothing usable is present. Never writes.
 */
export declare function adoptGmailMcpCredentials(file: GoogleFilePort, homeDirectory: string): GoogleOAuthCredentials | null;
/** Build the safe-to-display summary. Never includes a secret value. */
export declare function summarizeCredentials(credentials: GoogleOAuthCredentials | null, now: number): GoogleCredentialSummary;
//# sourceMappingURL=credential-adoption.d.ts.map