import { Ct as CredentialTypeDefinition, P as WorkflowDefinition, St as CredentialType, Tt as CredentialTypeRegistry, _ as WorkflowRepository, _t as CredentialOAuth2AuthDefinition, bt as CredentialSessionService, ct as AnyCredentialType, dt as CredentialFieldSchema, ft as CredentialHealth, ht as CredentialJsonRecord, lt as CredentialBinding, mt as CredentialInstanceRecord, pt as CredentialInstanceId, st as McpServerDeclaration, ut as CredentialBindingKey, vt as CredentialRequirement, wt as CredentialTypeId } from "./ItemsInputNormalizer-C2gLv7d9.js";
import { r as AppConfig } from "./CodemationAppContext-CA4xzGA6.js";
import { u as LoggerFactory } from "./CodemationWhitelabelConfig-CPKKZwGp.js";
import { a as CredentialInstanceWithSecretsDto, i as CredentialInstanceDto, l as WorkflowCredentialHealthDto, r as CreateCredentialInstanceRequest, s as UpdateCredentialInstanceRequest } from "./CredentialContractsRegistry-BUODyn3G.js";

//#region src/domain/credentials/CredentialTypeRegistryImpl.d.ts
type CredentialTypeSource = "plugin" | "config" | "controlPlane";
declare class CredentialTypeRegistryImpl implements CredentialTypeRegistry {
  private readonly loggers;
  private readonly entries;
  private readonly bySource;
  constructor(loggers: LoggerFactory);
  merge(source: CredentialTypeSource, types: ReadonlyArray<AnyCredentialType>): void;
  mergeDefinitions(source: CredentialTypeSource, definitions: ReadonlyArray<CredentialTypeDefinition>): void;
  clear(source: CredentialTypeSource): void;
  listTypes(): ReadonlyArray<CredentialTypeDefinition>;
  getType(typeId: CredentialTypeId): CredentialTypeDefinition | undefined;
  getCredentialType(typeId: CredentialTypeId): AnyCredentialType | undefined;
  private insert;
  private recordEntry;
  private createUnsupportedSessionFactory;
  private createUnsupportedHealthTester;
}
//#endregion
//#region src/mcp/McpServerCatalog.d.ts
type McpServerDeclarationSource = "plugin" | "config" | "controlPlane";
declare class McpServerCatalog {
  private readonly loggers;
  private readonly entries;
  private readonly bySource;
  private readonly env;
  constructor(loggers: LoggerFactory, appConfig: AppConfig);
  merge(source: McpServerDeclarationSource, declarations: ReadonlyArray<McpServerDeclaration>): void;
  get(id: string): McpServerDeclaration | undefined;
  getAll(): readonly McpServerDeclaration[];
  clear(source: McpServerDeclarationSource): void;
  private validate;
}
//#endregion
//#region src/domain/credentials/WorkflowCredentialNodeResolver.d.ts
type WorkflowCredentialSlotRef = Readonly<{
  workflowId: string;
  nodeId: string;
  nodeName: string;
  requirement: CredentialRequirement;
}>;
declare class WorkflowCredentialNodeResolver {
  private readonly mcpCatalog?;
  constructor(mcpCatalog?: McpServerCatalog | undefined);
  describeCredentialNodeDisplay(workflow: WorkflowDefinition, nodeId: string): string;
  isCredentialNodeIdInWorkflow(workflow: WorkflowDefinition, nodeId: string): boolean;
  findRequirement(workflow: WorkflowDefinition, nodeId: string, slotKey: string): Readonly<{
    nodeName: string;
    requirement: CredentialRequirement;
  }> | undefined;
  listSlots(workflow: WorkflowDefinition): ReadonlyArray<WorkflowCredentialSlotRef>;
  private findDirectRequirement;
  private addRecursiveAgentSlots;
  private addSlotsForRequirements;
  private findRecursiveConnectionNode;
  private buildRecursiveDisplayLabel;
  private collectAncestorToolLabels;
}
//#endregion
//#region src/domain/credentials/CredentialFieldEnvOverlayService.d.ts
declare class CredentialFieldEnvOverlayService {
  private readonly appConfig;
  constructor(appConfig: AppConfig);
  isFieldResolvedFromEnv(field: CredentialFieldSchema): boolean;
  apply(args: Readonly<{
    definition: CredentialTypeDefinition;
    publicConfig: JsonRecord;
    material: JsonRecord;
  }>): Readonly<{
    resolvedPublicConfig: JsonRecord;
    resolvedMaterial: JsonRecord;
  }>;
}
//#endregion
//#region src/domain/credentials/CredentialSecretCipher.d.ts
declare class CredentialSecretCipher {
  private readonly appConfig;
  private static readonly algorithm;
  private static readonly currentSchemaVersion;
  private static readonly ivLength;
  private static readonly HKDF_SALT;
  private static readonly HKDF_INFO;
  constructor(appConfig: AppConfig);
  encrypt(value: JsonRecord): Readonly<{
    encryptedJson: string;
    encryptionKeyId: string;
    schemaVersion: number;
  }>;
  decrypt(record: Readonly<{
    encryptedJson: string;
    encryptionKeyId: string;
    schemaVersion: number;
  }>): JsonRecord;
  private resolveKeyMaterialV2;
  private resolveKeyMaterialV1;
  private resolveBase64Key32Bytes;
  private resolveKeyId;
}
//#endregion
//#region src/domain/credentials/CredentialMaterialResolver.d.ts
declare class CredentialMaterialResolver {
  private readonly credentialStore;
  private readonly credentialSecretCipher;
  private readonly appConfig;
  constructor(credentialStore: CredentialStore, credentialSecretCipher: CredentialSecretCipher, appConfig: AppConfig);
  resolveMaterial(instance: CredentialInstanceRecord$1): Promise<JsonRecord>;
  private resolveEnvMaterial;
}
//#endregion
//#region src/domain/credentials/CredentialOAuth2ScopeResolver.d.ts
declare class CredentialOAuth2ScopeResolver {
  resolveRequestedScopes(auth: CredentialOAuth2AuthDefinition, publicConfig: JsonRecord): ReadonlyArray<string>;
  private resolveString;
  private resolveScopeList;
  private dedupe;
}
//#endregion
//#region src/domain/credentials/CredentialInstanceService.d.ts
declare class CredentialInstanceService {
  private readonly credentialStore;
  private readonly credentialTypeRegistry;
  private readonly credentialSecretCipher;
  private readonly credentialFieldEnvOverlayService;
  private readonly credentialMaterialResolver;
  private readonly credentialOAuth2ScopeResolver;
  private readonly credentialSessionService;
  constructor(credentialStore: CredentialStore, credentialTypeRegistry: CredentialTypeRegistryImpl, credentialSecretCipher: CredentialSecretCipher, credentialFieldEnvOverlayService: CredentialFieldEnvOverlayService, credentialMaterialResolver: CredentialMaterialResolver, credentialOAuth2ScopeResolver: CredentialOAuth2ScopeResolver, credentialSessionService: MutableCredentialSessionService);
  listInstances(): Promise<ReadonlyArray<CredentialInstanceDto>>;
  getInstance(instanceId: CredentialInstanceId): Promise<CredentialInstanceDto | undefined>;
  getInstanceWithSecrets(instanceId: CredentialInstanceId): Promise<CredentialInstanceWithSecretsDto | undefined>;
  create(request: CreateCredentialInstanceRequest): Promise<CredentialInstanceDto>;
  update(instanceId: CredentialInstanceId, request: UpdateCredentialInstanceRequest): Promise<CredentialInstanceDto>;
  delete(instanceId: CredentialInstanceId): Promise<void>;
  disconnectOAuth2(instanceId: CredentialInstanceId): Promise<CredentialInstanceDto>;
  requireInstance(instanceId: CredentialInstanceId): Promise<CredentialInstanceRecord$1>;
  private createSecretRef;
  private createSecretMaterial;
  private validateRequestFields;
  private stripEnvManagedFieldValues;
  private assertRequiredFields;
  private assertRequiredEnvFields;
  private requireCredentialType;
  markOAuth2Connected(instanceId: CredentialInstanceId, connectedAt: string): Promise<void>;
  private toDto;
  private toOAuth2ConnectionDto;
}
//#endregion
//#region src/domain/credentials/CredentialBindingService.d.ts
declare class CredentialBindingService {
  private readonly credentialStore;
  private readonly credentialInstanceService;
  private readonly workflowRepository;
  private readonly credentialSessionService;
  private readonly workflowCredentialNodeResolver;
  private readonly logger;
  constructor(credentialStore: CredentialStore, credentialInstanceService: CredentialInstanceService, workflowRepository: WorkflowRepository, credentialSessionService: MutableCredentialSessionService, workflowCredentialNodeResolver: WorkflowCredentialNodeResolver, loggerFactory: LoggerFactory);
  upsertBinding(args: Readonly<{
    workflowId: string;
    nodeId: string;
    slotKey: string;
    instanceId: CredentialInstanceId;
  }>): Promise<CredentialBinding>;
  assertRequiredCredentialsBound(workflowId: string): Promise<void>;
  listWorkflowHealth(workflowId: string): Promise<WorkflowCredentialHealthDto>;
  private requireWorkflow;
  private requireRequirement;
  private toBindingKeyString;
}
//#endregion
//#region src/domain/credentials/CredentialServices.d.ts
type JsonRecord = CredentialJsonRecord;
type CredentialSecretRef = Readonly<{
  kind: "db";
} | {
  kind: "env";
  envByField: Readonly<Record<string, string>>;
} | {
  kind: "code";
  value: JsonRecord;
}>;
type CredentialInstanceRecord$1<TPublicConfig extends JsonRecord = JsonRecord> = Readonly<Omit<CredentialInstanceRecord<TPublicConfig>, "secretRef"> & {
  secretRef: CredentialSecretRef;
}>;
type CredentialSecretMaterialRecord = Readonly<{
  instanceId: CredentialInstanceId;
  encryptedJson: string;
  encryptionKeyId: string;
  schemaVersion: number;
  updatedAt: string;
}>;
type CredentialOAuth2MaterialMetadata = Readonly<{
  providerId: string;
  connectedEmail?: string;
  connectedAt?: string;
  scopes: ReadonlyArray<string>;
  updatedAt: string;
}>;
type CredentialOAuth2MaterialRecord = Readonly<{
  instanceId: CredentialInstanceId;
} & CredentialSecretMaterialRecord & CredentialOAuth2MaterialMetadata>;
type CredentialOAuth2StateRecord = Readonly<{
  state: string;
  instanceId: CredentialInstanceId;
  codeVerifier?: string;
  providerId?: string;
  requestedScopes: ReadonlyArray<string>;
  createdAt: string;
  expiresAt: string;
}>;
type CredentialTestRecord = Readonly<{
  testId: string;
  instanceId: CredentialInstanceId;
  health: CredentialHealth;
  testedAt: string;
  expiresAt?: string;
}>;
interface CredentialStore {
  listInstances(): Promise<ReadonlyArray<CredentialInstanceRecord$1>>;
  getInstance(instanceId: CredentialInstanceId): Promise<CredentialInstanceRecord$1 | undefined>;
  saveInstance(args: Readonly<{
    instance: CredentialInstanceRecord$1;
    secretMaterial?: CredentialSecretMaterialRecord;
  }>): Promise<void>;
  deleteInstance(instanceId: CredentialInstanceId): Promise<void>;
  getSecretMaterial(instanceId: CredentialInstanceId): Promise<CredentialSecretMaterialRecord | undefined>;
  createOAuth2State(record: CredentialOAuth2StateRecord): Promise<void>;
  consumeOAuth2State(state: string): Promise<CredentialOAuth2StateRecord | undefined>;
  getOAuth2Material(instanceId: CredentialInstanceId): Promise<CredentialOAuth2MaterialRecord | undefined>;
  saveOAuth2Material(args: Readonly<{
    instanceId: CredentialInstanceId;
    encryptedJson: string;
    encryptionKeyId: string;
    schemaVersion: number;
    metadata: CredentialOAuth2MaterialMetadata;
  }>): Promise<void>;
  deleteOAuth2Material(instanceId: CredentialInstanceId): Promise<void>;
  upsertBinding(binding: CredentialBinding): Promise<void>;
  getBinding(key: CredentialBindingKey): Promise<CredentialBinding | undefined>;
  listBindingsByWorkflowId(workflowId: string): Promise<ReadonlyArray<CredentialBinding>>;
  saveTestResult(record: CredentialTestRecord): Promise<void>;
  getLatestTestResult(instanceId: CredentialInstanceId): Promise<CredentialTestRecord | undefined>;
  getLatestTestResults(instanceIds: ReadonlyArray<CredentialInstanceId>): Promise<ReadonlyMap<CredentialInstanceId, CredentialTestRecord>>;
}
type CredentialType$1<TPublicConfig extends JsonRecord = JsonRecord, TMaterial extends JsonRecord = JsonRecord, TSession = unknown> = CredentialType<TPublicConfig, TMaterial, TSession>;
type MutableCredentialSessionService = CredentialSessionService & Readonly<{
  evictInstance(instanceId: CredentialInstanceId): void;
  evictBinding(bindingKey: CredentialBindingKey): void;
}>;
//#endregion
export { CredentialSecretCipher as a, CredentialInstanceService as i, CredentialType$1 as n, McpServerCatalog as o, CredentialBindingService as r, CredentialStore as t };
//# sourceMappingURL=CredentialServices-vjUDU7PW.d.ts.map