import { OAuth2Client } from 'google-auth-library';
/**
 * Build an authenticated client for `account` (default: GOOGLE_MCP_ACCOUNT) from
 * its stored token. The library auto-refreshes the access token from the refresh
 * token as needed.
 */
export declare function authorizedClient(account?: string): Promise<OAuth2Client>;
/**
 * True when an error is Google's token endpoint refusing the stored refresh
 * token (`invalid_grant`: expired or revoked). No retry with the same client
 * can succeed, but a rebuild from disk heals the instance after a re-auth.
 * A false negative degrades to the plain error envelope; the shape check
 * makes a false positive structurally impossible.
 */
export declare function isInvalidGrant(error: unknown): boolean;
/**
 * Run the browser consent flow for `account` and persist its token. The token
 * file is written 0600 inside a 0700 tokens dir; the consent requests offline
 * access and forces the screen so a refresh token is always returned. The flow
 * carries a random `state` (verified at the callback: any browser tab can fire
 * requests at the loopback port, since CORS blocks reads, not sends, so only
 * the redirect Google issued for this flow is accepted) and PKCE (RFC 8252
 * section 8.1: a local process that wins a race for the port cannot exchange
 * an intercepted code without the verifier). `port`, `openBrowser`, and
 * `timeoutMs` are injectable for testing; the callback server is closed on
 * every exit path, including an abandoned consent. `loginHint` prefills the
 * Google account chooser when the account label is not itself an email
 * (e.g. a short alias like `personal`).
 */
export declare function runAuthFlow(account?: string, options?: {
    port?: number;
    openBrowser?: (url: string) => unknown;
    loginHint?: string;
    timeoutMs?: number;
}): Promise<void>;
//# sourceMappingURL=oauth.d.ts.map