import { type PendingAuth } from "./pending.js";
import type { StepOutcome } from "./steps.js";
export interface StoredTokens {
    client_id: string;
    access_token: string;
    refresh_token?: string;
    expiry_date: number;
    scope: string;
    token_type: string;
    obtained_at: string;
}
export interface StoredProfile {
    email: string;
    verified_email: boolean;
    name?: string;
    picture?: string;
    sub: string;
    updated_at: string;
}
/**
 * Did this install adopt a shared OAuth client via `auth join` (rather than a
 * from-scratch `auth setup`)? Joined teammates can't touch the shared project's
 * Cloud Console, so `access_denied` guidance must point them at the distributor.
 */
export declare function wasJoinedSetup(): boolean;
/**
 * Google returns `access_denied` most often because the user stopped at the
 * "Google hasn't verified this app" screen (clicking "Back to safety" instead
 * of Advanced → Go), and occasionally because of a Testing-mode test-user
 * gap or a Production user-cap limit. A joined teammate can't and shouldn't
 * touch the shared project's Cloud Console, so the guidance branches on
 * `joined` and never sends them there. Pure + unit-tested.
 */
export declare function accessDeniedCliInstructions(account: string | undefined, joined: boolean): string[];
export interface PrepareOptions {
    expectedAccount?: string;
}
export interface PrepareOutcome {
    pending: PendingAuth;
    htmlPath: string;
    credentialsPresent: boolean;
}
/**
 * Phase 1: generate the auth URL, reserve a port, persist pending state,
 * write setup.html with the authenticate button. Returns immediately so the
 * agent can relay instructions to the user BEFORE any process blocks on a
 * callback. Call `awaitPendingAuth` after instructing the user.
 */
export declare function preparePendingAuth(options?: PrepareOptions): Promise<PrepareOutcome | {
    error: string;
    code: string;
}>;
/**
 * Phase 2: read pending state, start the callback server, block until the
 * user authenticates (or timeout). Runs the token exchange, fetches the
 * userinfo to identify the account, writes tokens + profile, updates
 * default account if first, regenerates setup.html without the banner.
 */
export declare function awaitPendingAuth(): Promise<StepOutcome>;
/**
 * Helper for callers (like `auth setup`) that want to expose the prepared
 * instructions to the user/agent as a StepOutcome. Does NOT block — just
 * wraps preparePendingAuth into the StepOutcome shape.
 */
export declare function advanceTokensObtained(options?: PrepareOptions): Promise<StepOutcome>;