import { type StoredTokens } from "../google/tokens.js";
export type Permanence = "permanent" | "testing-7-day" | "pre-publish-7-day";
export interface AccountHealth {
    email: string;
    obtained_at: string;
    permanence: Permanence;
    permanence_detail: string;
}
/**
 * Compare an account's token-issuance timestamp against the publish
 * timestamp in setup state to classify token permanence. Returns null when
 * the account has no stored tokens.
 */
export declare function summarizeAccountHealth(email: string): AccountHealth | null;
export type UnverifiedAppWarning = "always" | "maybe";
/**
 * Predict whether the "Google hasn't verified this app" intermediate
 * screen will appear during the OAuth consent flow for `email`.
 *
 *   - "always": personal Gmail account, OR app still in Testing state.
 *     The warning shows every time and the user must click "Advanced"
 *     and then "Go to <app name> (unsafe)" to proceed.
 *   - "maybe": Workspace account + published app. The warning is
 *     suppressed if the Workspace admin has added the OAuth client to
 *     their app-trust policy; otherwise it appears. We can't detect
 *     admin policy from this side, so we hedge.
 *
 * The action is the same either way (click Advanced → Go to (unsafe)),
 * but the instruction can be more emphatic when we know it will fire.
 */
export declare function predictUnverifiedAppWarning(email: string | undefined, published: boolean): UnverifiedAppWarning;
export interface RestrictedScopeProbe {
    ok: boolean;
    detail: string;
}
/**
 * Probe the user's most-restricted scope to verify the unverified-app
 * Restricted-scope access is actually working at the API level. We use
 * Gmail's `users/me/profile` endpoint because it requires `gmail.modify`
 * (a Restricted scope per Google's classification). A 200 here is the
 * positive signal that "your tokens work for the most-stringent scope
 * Google checks." Skipped (returned ok with a note) if the gmail scope
 * wasn't granted to begin with.
 */
export declare function probeRestrictedScope(tokens: StoredTokens): Promise<RestrictedScopeProbe>;