/**
 * What is already set up.
 *
 * Idempotency here is deliberately not a journal of "steps I previously ran".
 * A journal lies as soon as anything changes outside the flow, a revoked app
 * password, a deleted OAuth client, a project someone removed. Instead every
 * check probes the actual state: is the secret present, is the config written,
 * does the credential still work. Re-running after a partial failure therefore
 * resumes from what is genuinely true rather than from what was once recorded.
 *
 * The one thing that cannot be probed locally is the OAuth publishing status,
 * which lives only in the Cloud Console. It is cached in config after being
 * read, and re-read from the console during a verification run.
 */
import type { GoogleConfigPort, GoogleSecretPort } from './types.js';
/** A snapshot of what already exists, all of it probed rather than remembered. */
export interface GoogleSetupState {
    /** An app password is present in the secret store. */
    readonly hasAppPassword: boolean;
    /** Every Gmail IMAP/SMTP config key needed to connect is populated. */
    readonly hasGmailConfig: boolean;
    /** The mail surface is switched on. */
    readonly gmailEnabled: boolean;
    /** The account address Gmail is configured for, or null. Not a secret. */
    readonly gmailUsername: string | null;
    /** A private calendar address is present in the secret store. */
    readonly hasCalendarAddress: boolean;
    /** An OAuth client id is configured. Client ids are not secrets (RFC 8252). */
    readonly oauthClientId: string | null;
    /** An OAuth client secret is present in the secret store. */
    readonly hasOAuthClientSecret: boolean;
    /** A refresh token is present in the secret store. */
    readonly hasRefreshToken: boolean;
    /** The Cloud project id recorded for the OAuth path, or null. */
    readonly projectId: string | null;
    /** Last known publishing status. 'unknown' until the console has been read. */
    readonly publishingStatus: 'testing' | 'in-production' | 'unknown';
}
/** Probe everything the Google flows care about. */
export declare function detectGoogleSetupState(deps: {
    readonly config: GoogleConfigPort;
    readonly secrets: GoogleSecretPort;
}): Promise<GoogleSetupState>;
/**
 * A plain-language description of the current state, for `--check` and for the
 * opening line of a run so the owner can see what will be skipped. Contains no
 * secret values, only whether each one is present.
 */
export declare function describeGoogleSetupState(state: GoogleSetupState): readonly string[];
/**
 * Whether the app-password path has everything it needs. Used to answer
 * "is there anything left to do" without running the flow.
 */
export declare function appPasswordPathComplete(state: GoogleSetupState): boolean;
/** Whether the OAuth path is complete *and* not on a seven-day fuse. */
export declare function oauthPathComplete(state: GoogleSetupState): boolean;
//# sourceMappingURL=setup-state.d.ts.map