/** Slack OAuth v2 helpers for managed Agent Native messaging installs. */
import type { SecretScope } from "../secrets/register.js";
import type { IntegrationInstallationHealth, UpsertIntegrationInstallationInput } from "./installations-store.js";
export declare const SLACK_AUTHORIZE_URL = "https://slack.com/oauth/v2/authorize";
export declare const SLACK_TOKEN_URL = "https://slack.com/api/oauth.v2.access";
export declare const SLACK_AUTH_TEST_URL = "https://slack.com/api/auth.test";
/** Scopes needed for contextual, file-aware Agent Native conversations. */
export declare const SLACK_AGENT_BOT_SCOPES: readonly ["assistant:write", "app_mentions:read", "channels:join", "channels:read", "channels:history", "chat:write", "files:read", "groups:history", "groups:read", "im:history", "im:read", "mpim:history", "mpim:read", "pins:read", "reactions:read", "users:read", "users:read.email"];
export interface SlackOAuthAccessResponse {
    ok?: boolean;
    error?: string;
    access_token?: string;
    refresh_token?: string;
    expires_in?: number;
    token_type?: string;
    scope?: string;
    bot_user_id?: string;
    app_id?: string;
    is_enterprise_install?: boolean;
    authed_user?: {
        id?: string;
    };
    team?: {
        id?: string;
        name?: string;
    } | null;
    enterprise?: {
        id?: string;
        name?: string;
    } | null;
}
export interface SlackAuthHealth {
    ok: boolean;
    health: IntegrationInstallationHealth;
    error: string | null;
    checkedAt: number;
    teamId: string | null;
    enterpriseId: string | null;
    botId: string | null;
    userId: string | null;
}
export interface SlackInstallSession {
    email?: string | null;
    orgId?: string | null;
    orgRole?: string | null;
}
export interface SlackInstallAccess {
    ownerEmail: string;
    orgId: string | null;
    secretScope: SecretScope;
    secretScopeId: string;
}
export declare function buildSlackAuthorizeUrl(options: {
    clientId: string;
    redirectUri: string;
    state: string;
    scopes?: readonly string[];
    userScopes?: readonly string[];
    teamId?: string;
}): string;
/** Exchange an OAuth code using Slack's preferred HTTP Basic authentication. */
export declare function exchangeSlackOAuthCode(options: {
    code: string;
    clientId: string;
    clientSecret: string;
    redirectUri: string;
    fetchImpl?: typeof fetch;
}): Promise<SlackOAuthAccessResponse>;
/**
 * Rotate an expiring Slack token. Slack refresh tokens are one-time-use, so
 * callers must atomically persist the returned access/refresh pair together.
 */
export declare function refreshSlackOAuthToken(options: {
    refreshToken: string;
    clientId: string;
    clientSecret: string;
    fetchImpl?: typeof fetch;
}): Promise<SlackOAuthAccessResponse>;
/** Validate a bot token without ever including it in an error or result. */
export declare function testSlackAuth(accessToken: string, fetchImpl?: typeof fetch): Promise<SlackAuthHealth>;
/** Stable team/app key used by webhook payloads and the installation store. */
export declare function slackInstallationKey(input: {
    teamId?: string | null;
    enterpriseId?: string | null;
    apiAppId?: string | null;
    isEnterpriseInstall?: boolean;
}): string;
/**
 * Convert a successful Slack response to the generic managed-install input.
 * The returned token bundle is server-only and must be passed directly to the
 * encrypted installation store, never to a route response.
 */
export declare function slackOAuthResponseToInstallation(response: SlackOAuthAccessResponse, access: SlackInstallAccess, now?: number): UpsertIntegrationInstallationInput;
/**
 * Pure session/role gate for OAuth install routes. The caller must supply a
 * server-verified session; org membership must be the active org context.
 */
export declare function assertSlackInstallAccess(session: SlackInstallSession | null | undefined): SlackInstallAccess;
//# sourceMappingURL=slack-oauth.d.ts.map