/**
 * Google OAuth credential storage manager
 * Handles per-session credential isolation with token refresh
 */
import type { CredentialResult, GogCredentials } from "./gog-oauth-types.js";
/** Google OAuth client type — determines allowed redirect URIs */
export type GoogleClientType = "installed" | "web" | "unknown";
/**
 * Set the path to the Google client credentials JSON file (from config).
 * Called once during gateway startup if `hooks.gogOAuth.googleClientCredentialsFile` is set.
 * The file format matches the Google Cloud Console download (supports "installed" and "web" types).
 */
export declare function setGoogleClientCredentialsFile(filePath: string): void;
/**
 * Get the credentials directory for an agent (new canonical path).
 * Aligned with GoogleAuthProvider's `auth-credentials/google/` layout.
 */
export declare function getCredentialsDir(agentId: string): string;
/**
 * Get the legacy credentials directory for an agent (gog-credentials/).
 * Used only for fallback reads and migration.
 */
export declare function getLegacyCredentialsDir(agentId: string): string;
/**
 * Build a sanitized credential filename from session key and email.
 */
export declare function buildCredentialFilename(sessionKey: string, email: string): string;
/**
 * Get the credentials file path for a session
 */
export declare function getCredentialsPath(agentId: string, sessionKey: string, email: string): string;
/**
 * Load session credentials if they exist.
 * Checks the canonical `auth-credentials/google/` path first, then falls back
 * to the legacy `gog-credentials/` path (and migrates if found).
 */
export declare function loadSessionCredentials(agentId: string, sessionKey: string, email?: string): Promise<GogCredentials | null>;
/**
 * Save credentials with secure file permissions (0600)
 */
export declare function saveSessionCredentials(credentials: GogCredentials): Promise<string>;
/**
 * Refresh access token using refresh token
 */
export declare function refreshAccessToken(credentials: GogCredentials): Promise<GogCredentials>;
/**
 * Check if access token is expired or about to expire (within 5 minutes)
 */
export declare function isTokenExpired(credentials: GogCredentials): boolean;
/**
 * Get valid credentials, refreshing if necessary.
 * Returns a discriminated CredentialResult so callers can distinguish
 * "no credentials" from "refresh failed" and surface actionable errors.
 */
export declare function getValidCredentials(agentId: string, sessionKey: string, email?: string): Promise<CredentialResult>;
/**
 * Revoke credentials with Google and delete local file
 */
export declare function revokeCredentials(agentId: string, sessionKey: string, email?: string): Promise<void>;
/**
 * List all credentials files for an agent (scans both new and legacy dirs)
 */
export declare function listCredentials(agentId: string): Promise<GogCredentials[]>;
/**
 * Get Google OAuth client ID.
 * Priority: env var GOOGLE_CLIENT_ID > gog CLI credentials.json file
 */
export declare function getGoogleClientId(): string;
/**
 * Get Google OAuth client secret.
 * Priority: env var GOOGLE_CLIENT_SECRET > gog CLI credentials.json file
 */
export declare function getGoogleClientSecret(): string;
/**
 * Get the detected Google OAuth client type from the credentials file.
 * Returns "unknown" if no credentials file was loaded or type couldn't be determined.
 */
export declare function getGoogleClientType(): GoogleClientType;
/**
 * Import OAuth tokens into the gog CLI keyring.
 * Core sync logic — writes a temp token file, runs `gog auth tokens import`, cleans up.
 * Caller is responsible for ensuring gog is installed and available.
 *
 * @param credentials - The OAuth credentials to import
 * @param env - Optional environment override (e.g. with GOG_KEYRING_BACKEND/PASSWORD).
 *              Defaults to process.env if not provided.
 * @returns Result indicating success or failure with error detail
 */
export declare function importTokensToGogKeyring(credentials: GogCredentials, env?: NodeJS.ProcessEnv): Promise<{
    success: boolean;
    error?: string;
}>;
/**
 * Sync OAuth tokens to gog CLI keyring so `gog gmail ...` commands work.
 * Best-effort: logs errors but never throws. Returns result so callers can
 * surface warnings to the user.
 */
export declare function syncToGogKeyring(credentials: GogCredentials): Promise<{
    success: boolean;
    error?: string;
}>;
