/**
 * Durable metadata and encrypted credentials for managed messaging installs.
 *
 * The installation row deliberately contains only provider metadata and an
 * opaque `app_secrets` key. OAuth access and refresh tokens are serialized as
 * one bundle and encrypted by the framework secrets vault. List/read helpers
 * never expose the secret key or token values.
 */
import type { SecretScope } from "../secrets/register.js";
export type IntegrationInstallationStatus = "connected" | "disconnected" | "revoked" | "error";
export type IntegrationInstallationHealth = "unknown" | "healthy" | "degraded" | "revoked";
export interface IntegrationTokenBundle {
    accessToken: string;
    refreshToken?: string;
    tokenType?: string;
    expiresAt?: number;
}
/** Safe-to-return installation metadata. No secret reference or token value. */
export interface IntegrationInstallation {
    id: string;
    platform: string;
    installationKey: string;
    teamId: string | null;
    teamName: string | null;
    enterpriseId: string | null;
    enterpriseName: string | null;
    isEnterpriseInstall: boolean;
    apiAppId: string | null;
    botUserId: string | null;
    scopes: string[];
    installedByExternalUserId: string | null;
    ownerEmail: string;
    orgId: string | null;
    status: IntegrationInstallationStatus;
    health: IntegrationInstallationHealth;
    lastError: string | null;
    healthCheckedAt: number | null;
    lastHealthyAt: number | null;
    tokenExpiresAt: number | null;
    createdAt: number;
    updatedAt: number;
    disconnectedAt: number | null;
}
export interface InstallationActor {
    userEmail: string;
    orgId?: string | null;
    /** Must come from a verified active organization membership. */
    isOrgAdmin?: boolean;
}
export interface UpsertIntegrationInstallationInput {
    platform: string;
    installationKey: string;
    teamId?: string | null;
    teamName?: string | null;
    enterpriseId?: string | null;
    enterpriseName?: string | null;
    isEnterpriseInstall?: boolean;
    apiAppId?: string | null;
    botUserId?: string | null;
    scopes?: readonly string[];
    installedByExternalUserId?: string | null;
    ownerEmail: string;
    orgId?: string | null;
    secretScope: SecretScope;
    secretScopeId: string;
    tokenBundle: IntegrationTokenBundle;
    status?: IntegrationInstallationStatus;
    health?: IntegrationInstallationHealth;
    lastError?: string | null;
    healthCheckedAt?: number | null;
    lastHealthyAt?: number | null;
    tokenExpiresAt?: number | null;
}
export interface IntegrationInstallationUpdate {
    teamName?: string | null;
    enterpriseName?: string | null;
    botUserId?: string | null;
    scopes?: readonly string[];
    status?: IntegrationInstallationStatus;
    health?: IntegrationInstallationHealth;
    lastError?: string | null;
    healthCheckedAt?: number | null;
    lastHealthyAt?: number | null;
    tokenExpiresAt?: number | null;
}
/**
 * Create or refresh a managed install. Re-installs may rotate tokens inside
 * the same owner/org scope, but cannot silently move an existing provider
 * installation into another Agent Native tenant.
 */
export declare function upsertIntegrationInstallation(input: UpsertIntegrationInstallationInput): Promise<IntegrationInstallation>;
/** List installations visible to the owner or active organization member. */
export declare function listIntegrationInstallations(actor: InstallationActor, platform?: string): Promise<IntegrationInstallation[]>;
/** Read one installation through owner/org visibility scoping. */
export declare function getIntegrationInstallation(id: string, actor: InstallationActor): Promise<IntegrationInstallation | null>;
/** Update non-secret installation metadata after an owner/admin access check. */
export declare function updateIntegrationInstallation(id: string, actor: InstallationActor, patch: IntegrationInstallationUpdate): Promise<IntegrationInstallation | null>;
/** Delete the encrypted token bundle and retain disconnected audit metadata. */
export declare function disconnectIntegrationInstallation(id: string, actor: InstallationActor): Promise<IntegrationInstallation | null>;
/**
 * Resolve credentials for a verified provider webhook/runtime path.
 *
 * This is intentionally separate from every user-facing list/read helper.
 * Callers must first authenticate the provider webhook (or run inside a
 * trusted OAuth callback) and must never log or return the result.
 */
export declare function resolveIntegrationTokenBundle(platform: string, installationKey: string): Promise<IntegrationTokenBundle | null>;
/** Safe metadata lookup for a verified provider event. */
export declare function getActiveIntegrationInstallationByKey(platform: string, installationKey: string): Promise<IntegrationInstallation | null>;
/** Resolve a connected installation by workspace or enterprise tenant id. */
export declare function getActiveIntegrationInstallationForTenant(platform: string, tenantId: string): Promise<IntegrationInstallation | null>;
//# sourceMappingURL=installations-store.d.ts.map