export declare const oauthTokensStore: import("../db/store-registry.js").Store;
export declare function ensureTable(): Promise<void>;
export declare function getOAuthTokens(provider: string, accountId: string, owner?: string): Promise<Record<string, unknown> | null>;
export interface OAuthTokenSnapshot {
    tokens: Record<string, unknown>;
    owner: string | null;
    revision: number;
    legacyRevision: number;
    storageVersion: string;
}
export declare function getOAuthTokenSnapshot(provider: string, accountId: string, owner: string): Promise<OAuthTokenSnapshot | null>;
export declare function getOAuthTokenSnapshotForUserOwner(provider: string, accountId: string, owner: string): Promise<OAuthTokenSnapshot | null>;
/**
 * Replace an existing credential bundle only when the caller still owns the
 * revision it read. This prevents a slow refresh/revoke flow from overwriting
 * a newer authorization completed in another process.
 */
export declare function replaceOAuthTokensIfRevision(provider: string, accountId: string, owner: string, expectedRevision: number, expectedLegacyRevision: number, expectedStorageVersion: string, tokens: Record<string, unknown>): Promise<boolean>;
export declare function deleteOAuthTokensIfRevision(provider: string, accountId: string, owner: string, expectedRevision: number, expectedLegacyRevision: number, expectedStorageVersion: string): Promise<boolean>;
export declare class OAuthAccountOwnedByOtherUserError extends Error {
    readonly statusCode = 409;
    readonly provider: string;
    readonly accountId: string;
    readonly existingOwner: string;
    readonly attemptedOwner: string;
    constructor(opts: {
        provider: string;
        accountId: string;
        existingOwner: string;
        attemptedOwner: string;
    });
}
export declare function saveOAuthTokens(provider: string, accountId: string, tokens: Record<string, unknown>, owner?: string): Promise<void>;
export declare function deleteOAuthTokens(provider: string, accountId?: string, owner?: string): Promise<number>;
export declare function listOAuthAccounts(provider: string): Promise<Array<{
    accountId: string;
    owner: string | null;
    tokens: Record<string, unknown>;
}>>;
export declare function listOAuthAccountsByOwner(provider: string, owner: string): Promise<Array<{
    accountId: string;
    displayName: string | null;
    tokens: Record<string, unknown>;
}>>;
export declare function setOAuthDisplayName(provider: string, accountId: string, displayName: string): Promise<void>;
/**
 * The stored `(account_id, owner)` pairs among `accountIds` for `provider`,
 * read in bounded batches so a whole organization costs a few queries rather
 * than one per member. Presence only; no token is read or decrypted.
 */
export declare function listOAuthTokenOwners(provider: string, accountIds: readonly string[]): Promise<Array<{
    accountId: string;
    owner: string | null;
}>>;
export declare function hasOAuthTokens(provider: string, owner: string, accountId?: string | null): Promise<boolean>;