/**
 * Authenticated access to Google Calendar API v3.
 *
 * Refresh happens HERE, direct to Google. The vendor app is a Desktop
 * (installed app) client, whose secret ships in brand config — Google states an
 * installed-app secret "is obviously not treated as a secret" — so there is no
 * server-side holder to delegate to and no reason to route through one.
 */
import { TokenStore, type TokenBlob } from "../auth/token-store.js";
export interface GoogleConfig {
    accountId: string;
    clientId: string;
    /** Ships in brand config alongside the client id. Sanctioned for installed
     *  apps; PKCE remains the protection against an intercepted code. */
    clientSecret: string;
    store: TokenStore;
}
export declare function buildQuery(q: Record<string, string | number | undefined>): string;
export declare function isExpiring(blob: TokenBlob): boolean;
/** Test seam. Production callers reach this through callCalendar. */
export declare function accessTokenForTest(config: GoogleConfig, doFetch: typeof fetch): Promise<string>;
export declare function callCalendar<T>(config: GoogleConfig, path: string, init?: {
    method?: string;
    body?: unknown;
    query?: Record<string, string | number | undefined>;
    fetchImpl?: typeof fetch;
}): Promise<T>;
/** The primary calendar's id IS the account's email address. Used instead of a
 *  userinfo call, because the identity scopes are deliberately not requested. */
export declare function resolvePrimaryEmail(config: GoogleConfig): Promise<string>;
//# sourceMappingURL=google-client.d.ts.map