/**
 * Org-scoped GitHub Personal Access Token settings.
 *
 * GitHub App installation tokens are the wrong credential for the `gh` CLI —
 * they hit "Resource not accessible by integration" on endpoints the CLI
 * needs regardless of the minted permission set. When an org pastes a PAT in
 * Settings, the sandbox `GH_TOKEN` injection sites and the
 * `github_refresh_token` tool use it instead of a minted installation token.
 * Tokens must be classic PATs whose account has access to the linked repos.
 *
 * Two kinds:
 * - `default` — the worker token every sandbox gets.
 * - `reviewer` — optional second token for review-board sessions, so PR
 *   reviews come from a different account than the author. When it isn't
 *   configured, review sessions fall back to the worker token.
 *
 * Both live in the generic `integration_settings` collection for the
 * `github` integration under a sentinel user id (the settings are org-wide,
 * but the schema keys settings per `(org, user)`). Tokens are never returned
 * to the browser — the routes only report whether each is configured.
 */
import type { GithubSubscriptionStorage } from './subscriptions.js';
export type GithubPatKind = 'default' | 'reviewer';
/** The PAT to install for `kind`, or null. `reviewer` falls back to the
 * worker token so review sessions still authenticate when no dedicated
 * reviewer token is configured. Fail-soft: storage errors (e.g. integration
 * storage not initialized in a partial test harness) read as "no PAT
 * configured" so token minting still works. */
export declare function getGithubPat(getStorage: () => GithubSubscriptionStorage, orgId: string, kind?: GithubPatKind): Promise<string | null>;
/** Which tokens are configured, without fallback semantics — feeds the
 * settings UI status badges. */
export declare function getGithubPatStatus(getStorage: () => GithubSubscriptionStorage, orgId: string): Promise<{
    configured: boolean;
    reviewerConfigured: boolean;
}>;
export declare function setGithubPat(storage: GithubSubscriptionStorage, orgId: string, pat: string, kind?: GithubPatKind): Promise<void>;
export declare function clearGithubPat(storage: GithubSubscriptionStorage, orgId: string, kind?: GithubPatKind): Promise<void>;
//# sourceMappingURL=pat.d.ts.map