/**
 * Google Auth module for GTM MCP Server
 *
 * Supports three auth modes (resolved in this order):
 *   1. Service Account key file (limited GTM support — see notes below)
 *   2. OAuth 2.0 user credentials via env vars and/or local token file
 *   3. Application Default Credentials (fallback)
 *
 * OAUTH CLIENT RESOLUTION:
 * ────────────────────────
 * The OAuth client ID / secret can come from one of two namespaces:
 *
 *   a) `GOOGLE_OAUTH_CLIENT_ID` / `GOOGLE_OAUTH_CLIENT_SECRET`     (preferred new names)
 *      Legacy `GOOGLE_CLIENT_ID` / `GOOGLE_CLIENT_SECRET` still work.
 *      Use this when YOU own the OAuth client (self-hosted / local dev).
 *
 *   b) `SAMARTH_GOOGLE_OAUTH_CLIENT_ID` / `SAMARTH_GOOGLE_OAUTH_CLIENT_SECRET`
 *      Reserved for the Samarth-hosted public OAuth app. The secret is NEVER
 *      hardcoded in this repo — it MUST be injected at runtime on the hosted
 *      backend. Public/distributed installs should leave the secret unset and
 *      rely on the hosted Samarth backend to perform the token exchange.
 *
 * TOKEN STORAGE:
 * ──────────────
 * The browser-based onboarding script (`npm run auth:google`) writes tokens to
 * a local file (default: `./.gtm-mcp-tokens.json`, override with
 * `GTM_MCP_TOKEN_FILE`). The file is in `.gitignore`. Env-var tokens
 * (`GOOGLE_REFRESH_TOKEN`) always take precedence if set.
 *
 * SERVICE ACCOUNT NOTES:
 * ─────────────────────
 * The Google Tag Manager API is a user-data API — it manages resources owned
 * by individual Google accounts. Service accounts are NOT granted GTM access
 * by default and will receive 403 errors. Either add the service account email
 * as a GTM user, or use Google Workspace Domain-Wide Delegation. See README.
 */
import { OAuth2Client } from 'google-auth-library';
export declare const GTM_SCOPES: string[];
export declare const GA4_ADMIN_READONLY_SCOPE = "https://www.googleapis.com/auth/analytics.readonly";
export declare const GA4_ADMIN_EDIT_SCOPE = "https://www.googleapis.com/auth/analytics.edit";
export declare const GA4_MANAGE_USERS_SCOPE = "https://www.googleapis.com/auth/analytics.manage.users";
export declare const GA4_SCOPES: string[];
export declare const ALL_SCOPES: string[];
export type AuthMode = 'oauth2' | 'service_account';
export interface AuthOptions {
    mode?: AuthMode;
    /** Path to service account JSON key file */
    serviceAccountKeyFile?: string;
    /** Email to impersonate when using service account + DWD */
    impersonateEmail?: string;
}
export interface OAuthClientCredentials {
    clientId: string;
    clientSecret: string;
    redirectUri: string;
    /** Which env namespace the credentials came from. */
    source: 'self-hosted' | 'samarth-hosted';
}
export interface StoredTokens {
    access_token?: string;
    refresh_token?: string;
    expiry_date?: number;
    scope?: string;
    token_type?: string;
}
export declare const DEFAULT_REDIRECT_URI = "http://localhost:3001/oauth/callback";
export declare const DEFAULT_TOKEN_FILE = ".gtm-mcp-tokens.json";
/**
 * Resolve OAuth client credentials from environment variables.
 *
 * Priority:
 *   1. SAMARTH_GOOGLE_OAUTH_CLIENT_ID/SECRET   (hosted Samarth app)
 *   2. GOOGLE_OAUTH_CLIENT_ID/SECRET           (preferred new names)
 *   3. GOOGLE_CLIENT_ID/SECRET                 (legacy)
 *
 * Returns null if no usable client is configured.
 */
export declare function resolveOAuthClient(): OAuthClientCredentials | null;
/** Resolve the local token file path (override with GTM_MCP_TOKEN_FILE). */
export declare function getTokenFilePath(): string;
/** Read tokens from the local token file. Returns null if missing or unreadable. */
export declare function readStoredTokens(filePath?: string): StoredTokens | null;
/** Write tokens to the local token file with restrictive permissions. */
export declare function writeStoredTokens(tokens: StoredTokens, filePath?: string): void;
/**
 * Build an authenticated Google API client.
 * Priority:
 *   1. Service account key file (if provided and file exists)
 *   2. OAuth2 — env tokens, then local token file, combined with resolved client
 *   3. Application Default Credentials
 */
export declare function buildGoogleAuth(opts?: AuthOptions): Promise<OAuth2Client>;
/**
 * Build an OAuth2Client from resolved env credentials (no tokens set).
 * Throws if no client is configured.
 */
export declare function buildOAuth2ClientForFlow(): OAuth2Client;
/**
 * Generate the OAuth2 authorization URL for first-time setup.
 */
export declare function getOAuthAuthorizationUrl(): string;
/**
 * Exchange an authorization code for tokens.
 * If `persist` is true (default), writes tokens to the local token file.
 * Always prints a summary so the user can also copy values into .env if they prefer.
 */
export declare function exchangeCodeForTokens(code: string, options?: {
    persist?: boolean;
}): Promise<StoredTokens>;
//# sourceMappingURL=googleAuth.d.ts.map