import { OAuth2Client } from "google-auth-library";
export type AuthMode = {
    mode: "oauth";
    clientId: string;
    clientSecret: string;
    refreshToken: string;
} | {
    mode: "service_account";
    keyFile: string;
} | {
    mode: "none";
};
/** A resolved, usable auth mode -- `none` never escapes resolveAuthMode(). */
export type ResolvedAuthMode = Exclude<AuthMode, {
    mode: "none";
}>;
/**
 * Decide which credential family to use, purely from env.
 *
 * Precedence (keyfile/SA-FIRST): an explicit service-account keyfile
 * (GOOGLE_APPLICATION_CREDENTIALS) wins -- it is the recommended, deterministic
 * signal for unattended/server installs. Otherwise a full user-OAuth triple
 * (GA4_CLIENT_ID + GA4_CLIENT_SECRET + GA4_REFRESH_TOKEN) selects the OAuth
 * family. If neither is configured, `none`.
 *
 * A partial OAuth set (e.g. client id + secret but no refresh token) does NOT
 * select OAuth -- it falls through to `none` so the user gets a clear
 * onboarding error rather than a silent half-config.
 */
export declare function selectAuthMode(env: NodeJS.ProcessEnv): AuthMode;
/** Clear onboarding error naming BOTH credential options. */
export declare const GA4_NO_CREDENTIALS_MESSAGE: string;
/**
 * Reconcile env + an optional config.json `credentials_file` into a single
 * usable AuthMode -- keyfile/SA-FIRST, then user-OAuth, else a LOUD error.
 *
 * Precedence, config-time and deterministic (NOT runtime failover):
 *   1. Explicit keyfile -- from GOOGLE_APPLICATION_CREDENTIALS (env) OR the
 *      config.json `credentials_file` argument. Either outranks a user-OAuth
 *      triple, even when both are present. When BOTH keyfile sources are set,
 *      the ENV keyfile wins over config.json (12-factor: env overrides the
 *      committed config without editing files).
 *   2. User-OAuth triple (GA4_CLIENT_ID + GA4_CLIENT_SECRET + GA4_REFRESH_TOKEN).
 *   3. Neither -> throw GA4_NO_CREDENTIALS_MESSAGE. Never a silent machine-local
 *      default; a later API 403 surfaces as the API error, not a credential swap.
 */
export declare function resolveAuthMode(env: NodeJS.ProcessEnv, configCredentialsFile?: string): ResolvedAuthMode;
/**
 * Build a google-auth-library OAuth2Client from a resolved user-OAuth mode.
 */
export declare function buildOAuth2Client(auth: {
    clientId: string;
    clientSecret: string;
    refreshToken: string;
}): OAuth2Client;
/** Constructor options handed to the GA4 SDK clients (data + admin). */
export interface Ga4ClientAuthOptions {
    /**
     * An explicit auth instance for the SDK. CRITICAL: the key MUST be `auth`,
     * not `authClient`. Both @google-analytics/data and @google-analytics/admin
     * default to the gRPC transport in Node, and google-gax's gRPC path reads
     * `options.auth || new GoogleAuth(options)` (google-gax grpc.js). It never
     * looks at `authClient` on that path -- so passing our OAuth2Client under
     * `authClient` is silently dropped and gax falls back to Application Default
     * Credentials, ignoring the user's refresh token entirely.
     */
    auth?: OAuth2Client;
    /** Service-account keyfile path (SA mode). */
    keyFile?: string;
}
/**
 * Translate a resolved AuthMode into the GA4 SDK constructor options.
 *   - oauth           -> { auth: OAuth2Client(refresh_token) }
 *   - service_account -> { keyFile }
 *   - none            -> {} (SDK falls back to ADC; a startup warning fires)
 *
 * `scopes` are added by the caller (SA/ADC needs them; OAuth ignores them).
 */
export declare function buildClientAuthOptions(authMode: AuthMode): Ga4ClientAuthOptions;