import type { ApiRoute } from '@mastra/core/server';
import type { RouteAuth } from '../../routes/route.js';
import type { StateSigner } from '../../state-signing.js';
import type { ChannelIdentityStorage } from '../../storage/domains/channel-identity/base.js';
import type { FactoryProjectsStorage } from '../../storage/domains/projects/base.js';
/**
 * Config for the web-initiated "Sign in with Slack" (OIDC) connect flow. All
 * values come from the env-supplied Slack app. Absent → the OIDC routes
 * respond with an error redirect and the list endpoint reports
 * `canConnect: false` so the UI hides its Connect button.
 */
interface SlackOidcConfig {
    clientId: string;
    clientSecret: string;
    /**
     * Public HTTPS origin the OIDC `redirect_uri` is built from (Slack rejects
     * plain-http redirect URLs, so locally this is the tunnel origin). Must also
     * be registered as a redirect URL on the Slack app.
     */
    redirectBaseUrl: string;
    /** Browser-facing origin post-connect redirects land on (the SPA host). */
    uiOrigin?: string;
}
/**
 * Slack account-linking routes.
 *
 * A link is only ever written by the OIDC flow below, where Slack itself
 * asserts the `(team, user)` pair in the id_token — so the web user has to
 * actually control the Slack account they bind. `/connect/slack` is just the
 * Slack-side entry point: it carries no identity and writes nothing, it only
 * sends the visitor to Connections, where the flow starts.
 */
export declare function createSlackConnectRoutes(deps: {
    auth: RouteAuth;
    accountLinks: ChannelIdentityStorage;
    /** Signs the OIDC `state`, binding the round-trip to the initiating tenant. */
    tenantStateSigner?: StateSigner;
    oidc?: SlackOidcConfig;
    /**
     * Factory projects domain, for validating (and listing to) the per-link
     * default factory. Unset → the default-factory PATCH route rejects.
     */
    projects?: FactoryProjectsStorage;
}): ApiRoute[];
export {};
//# sourceMappingURL=connect-route.d.ts.map