import type { IncomingMessage, IntegrationExecutionContext } from "./types.js";
export type IntegrationIdentityDeclineReason = "unverified" | "guest" | "unlinked-workspace" | "membership-check-failed";
/**
 * Thrown when the default Slack DM identity ladder declines to run a message.
 * `reason` is a stable machine-readable discriminator (used e.g. to dedupe
 * decline replies); `userFacingMessage` is safe to send back to the sender as
 * a polite reply; `message` stays log-only.
 */
export declare class IntegrationIdentityDeclinedError extends Error {
    readonly reason: IntegrationIdentityDeclineReason;
    readonly userFacingMessage: string;
    constructor(reason: IntegrationIdentityDeclineReason, message: string, userFacingMessage: string);
}
/**
 * Resolve the default integration principal.
 *
 * Slack DMs become a user principal only after the adapter has verified the
 * sender email and the email is already a member of the managed installation's
 * Agent Native organization. Hydrated full workspace members whose email is
 * missing, unverified, or not an organization member run as an anonymous
 * org-scoped service principal instead — the same visibility shared channels
 * get. Hydration failures, guests/external members, and workspaces without a
 * connected organization are declined with a user-facing message. Shared
 * channels deliberately stay service-scoped so a channel message cannot borrow
 * one participant's private permissions.
 */
export declare function resolveDefaultIntegrationExecutionContext(incoming: IncomingMessage): Promise<IntegrationExecutionContext>;
//# sourceMappingURL=identity.d.ts.map