/**
 * The Google-backed implementation of the daemon's `calendar.*` verbs.
 *
 * This is the piece that was missing. `calendar.events.list`,
 * `calendar.events.get`, `calendar.events.create`, `calendar.ics.export` and
 * `calendar.ics.import` were cataloged with `invokable: false` because no
 * daemon-reachable implementation existed, the connector lived inside one
 * product. This adapts the hoisted connector onto the service slice the verb
 * handlers are written against, so the daemon serves them for real, with no
 * product process attached.
 *
 * Credentials come from the daemon's own tier by the platform-wide derivation
 * (`daemonSecretKeyFor`), which is exactly why `setup-plan.ts` derives its
 * secret names the same way: a hand-written name would sit outside daemon
 * ownership and fail to follow a node handover, and the symptom would be
 * calendar going quiet on the node that took over with nothing in the logs to
 * explain it.
 *
 * Every failure the connector reports carries a `problem` and a `fix`, and both
 * survive into the `GatewayVerbError` a caller sees. A missing scope answers
 * "the credential lacks the required permission, re-authorize with the needed
 * scope", not a bare 500.
 */
import type { CalendarGatewayService } from '../control-plane/routes/calendar.js';
import { type CalendarUntrustedIngestRecorder } from '../calendar/untrusted-events.js';
import { type GoogleConnectionSources } from './connection.js';
import type { GoogleFetchPort } from './oauth-loopback.js';
import type { GoogleApiFetchPort } from './api-client.js';
/** Everything the service needs, all of it injected. */
export interface GoogleCalendarGatewayServiceOptions {
    readonly sources: GoogleConnectionSources;
    readonly fetch: GoogleFetchPort & GoogleApiFetchPort;
    /** Wall clock, injected so `createdAt` is deterministic under test. */
    readonly now?: () => number;
    /**
     * Records that a turn read untrusted event content.
     *
     * An event whose organizer is somebody other than the owner was written by
     * that somebody, and reading it is the same exposure as reading their mail.
     * Recorded from the READ paths, `listEvents`, `getEvent`, `exportIcs` and
     * `importIcs`, each of which runs because a caller asked. An event Google
     * says the owner organized (`organizer.self`) records nothing: the owner wrote it.
     * See calendar/untrusted-events.ts.
     */
    readonly recordUntrustedIngest?: CalendarUntrustedIngestRecorder | undefined;
}
export declare function createGoogleCalendarGatewayService(options: GoogleCalendarGatewayServiceOptions): CalendarGatewayService;
//# sourceMappingURL=gateway-calendar-service.d.ts.map