import { type IntegrationDefinition } from "@opengeni/capabilities";
import { type Settings } from "@opengeni/config";
import { OAuthStartResponse, type ApiIntegrationOAuthStartRequest, type ConnectionOwnership } from "@opengeni/contracts";
import { type ApiRouteDeps } from "@opengeni/core";
import { ExternalActorContinuation } from "@opengeni/contracts/external-identities";
export declare function startApiIntegrationProviderOAuth(deps: ApiRouteDeps, input: {
    accountId: string;
    workspaceId: string;
    subjectId: string;
    /**
     * False for every principal that cannot own a personal Connection (API
     * keys, the configured key, services, agent attempts). Resolved by the
     * route from the live authenticated principal, never inferred here.
     */
    personalOwnershipAllowed: boolean;
    externalContinuation?: ExternalActorContinuation;
    connectAttemptId?: string;
    requestUrl: string;
    payload: ApiIntegrationOAuthStartRequest;
}): Promise<OAuthStartResponse>;
export declare function completeApiIntegrationProviderOAuth(deps: ApiRouteDeps, input: {
    code?: string | undefined;
    state?: string | undefined;
    error?: string | undefined;
    requestUrl: string;
}): Promise<{
    redirectTo: string;
    exactReturn?: boolean;
}>;
/** Configuration readiness only: consent and installation are still separate. */
export declare function curatedOAuthReadiness(settings: Settings, definition: IntegrationDefinition): {
    configured: boolean;
    ownership: ConnectionOwnership[];
};
export declare function isApiIntegrationProviderOAuthState(value: string | undefined, settings: Settings): boolean;