import type { ConnectorId, CredentialId, EnvironmentId, TenantId } from '../ids/index.js';
import type { AuthConfig, AuthType } from './core.js';
export type EnvironmentTier = 'production' | 'staging' | 'development' | 'testing';
export interface EnvironmentDescriptor {
    id: EnvironmentId;
    name: string;
    tier: EnvironmentTier;
    orgId?: string;
    metadata?: Record<string, unknown>;
}
export interface TenantDescriptor {
    id: TenantId;
    name: string;
    metadata?: Record<string, unknown>;
}
export interface TenantRateLimitConfig {
    maxRequests: number;
    windowMs: number;
}
export interface CredentialRef {
    readonly id: CredentialId;
    readonly connectorId: ConnectorId;
    readonly tenantId: TenantId;
    readonly label: string;
    readonly authType: AuthType;
    readonly createdAt: number;
    readonly expiresAt?: number;
}
export interface CredentialVault {
    store(tenantId: TenantId, connectorId: ConnectorId, label: string, auth: AuthConfig): Promise<CredentialRef>;
    /** Host-authority lookup. Tenant-facing code must use {@link retrieveForScope}. */
    retrieve(credentialId: CredentialId): Promise<AuthConfig | undefined>;
    /**
     * Resolve only when the credential atomically belongs to both authorities.
     * Implementations must not perform an unscoped read followed by a separate
     * metadata check: a concurrent rotation must not cross the scope boundary.
     */
    retrieveForScope(tenantId: TenantId, connectorId: ConnectorId, credentialId: CredentialId): Promise<AuthConfig | undefined>;
    /** Host-authority deletion. Tenant-facing code must use {@link revokeForTenant}. */
    revoke(credentialId: CredentialId): Promise<boolean>;
    /** Atomically delete only when the credential belongs to `tenantId`. */
    revokeForTenant(tenantId: TenantId, credentialId: CredentialId): Promise<boolean>;
    list(tenantId: TenantId, connectorId?: ConnectorId): Promise<CredentialRef[]>;
}
//# sourceMappingURL=tenant.d.ts.map