/**
 * Vault keys + env overrides + token validators shared by the channel, its
 * subcommands, and the interactive setup wizard. Kept in their own module so the
 * wizard / pair-flow helpers can import them without pulling in the plugin's
 * full index.
 */
import { z } from '@moxxy/sdk';
/** Vault key for the Slack bot OAuth token (`xoxb-…`). */
export declare const SLACK_BOT_TOKEN_KEY = "slack_bot_token";
/** Vault key for the Slack app signing secret (HMAC over the raw request body). */
export declare const SLACK_SIGNING_SECRET_KEY = "slack_signing_secret";
/**
 * Vault key for the authorized team/channel set (TOFU pairing). Stored as a
 * JSON string of an authorization record so we can grow what we pin without a
 * format change (today: `{ teamId, channelId? }`).
 */
export declare const SLACK_AUTHORIZED_KEY = "slack_authorized";
/** Env override for the bot token (beats the vault, matching every other channel). */
export declare const SLACK_BOT_TOKEN_ENV = "MOXXY_SLACK_BOT_TOKEN";
/** Env override for the signing secret. */
export declare const SLACK_SIGNING_SECRET_ENV = "MOXXY_SLACK_SIGNING_SECRET";
/** A Slack bot token always starts with `xoxb-`. */
export declare const SLACK_BOT_TOKEN_RE: RegExp;
/** zod validator for a bot token (shape only — connectivity is tested via `auth.test`). */
export declare const slackBotTokenSchema: z.ZodString;
/** zod validator for a signing secret (hex-ish; Slack uses a 32-byte hex secret). */
export declare const slackSigningSecretSchema: z.ZodString;
/**
 * Resolve the bot token: env override first, then the vault (the shared
 * env→vault resolution in @moxxy/channel-kit). Returns null when neither is
 * set. Trimmed; never returns an empty string.
 */
export declare function resolveBotToken(vault: {
    get(name: string): Promise<string | null>;
}): Promise<string | null>;
/** Resolve the signing secret: env override first, then the vault. */
export declare function resolveSigningSecret(vault: {
    get(name: string): Promise<string | null>;
}): Promise<string | null>;
/** What we persist under {@link SLACK_AUTHORIZED_KEY}. */
export interface SlackAuthorization {
    readonly teamId: string;
    /** Optionally narrow authorization to a single channel. */
    readonly channelId?: string;
}
/** Parse the stored authorization record. Returns null for missing/corrupt. */
export declare function parseAuthorization(raw: string | null | undefined): SlackAuthorization | null;
/** Does an inbound event from `(teamId, channelId)` match the stored authorization? */
export declare function authorizationMatches(auth: SlackAuthorization | null, teamId: string | undefined, channelId: string | undefined): boolean;
//# sourceMappingURL=keys.d.ts.map