/**
 * @module integrations/enterprise/types
 *
 * Shared vocabulary for the enterprise-connections subsystem: org-level admin
 * grants (Google Workspace DWD, Microsoft 365 tenant, Okta, Slack, GitHub App,
 * 1Password Connect), the merged people roster, and bulk-provisioned per-user
 * grants. Mirrors the cross-repo contract with the SkyKoi platform — the kind
 * strings and config shapes here are exact and must not drift.
 */
export declare const ENTERPRISE_CONNECTION_KINDS: readonly ["google-dwd", "ms-tenant", "okta", "slack-org", "github-app", "op-vault"];
export type EnterpriseConnectionKind = (typeof ENTERPRISE_CONNECTION_KINDS)[number];
export declare function isEnterpriseConnectionKind(value: string): value is EnterpriseConnectionKind;
export type EnterpriseConnectionStatus = "pending" | "connected" | "error";
export type EnterpriseGrantStatus = "active" | "error" | "pending";
export type GoogleDwdConfig = {
    /** Full service-account key JSON, as a string. */
    serviceAccountJson: string;
    adminEmail: string;
    domain?: string;
    scopes: string[];
};
export type MsTenantConfig = {
    tenantId: string;
    clientId: string;
    clientSecret: string;
};
export type OktaConfig = {
    /** e.g. acme.okta.com */
    domain: string;
    apiToken: string;
};
export type SlackOrgConfig = {
    botToken: string;
    teamId?: string;
    teamName?: string;
    enterpriseId?: string;
};
export type GithubAppConfig = {
    appId: string;
    privateKeyPem: string;
    installationId: string;
    appSlug?: string;
    orgLogin?: string;
};
export type OpVaultConfig = {
    host: string;
    token: string;
    vaultIds?: string[];
};
/** Typed view over a connection's free-form config blob. */
export declare function connectionConfig<T>(conn: EnterpriseConnection): T;
export type EnterpriseConnection = {
    id?: string;
    kind: EnterpriseConnectionKind;
    status: EnterpriseConnectionStatus;
    config: Record<string, unknown>;
    meta?: Record<string, unknown>;
    updatedAt?: string;
    /** Where this entry came from. Platform sync merges by kind. */
    source?: "platform" | "local";
    /** A pinned local entry survives platform sync for the same kind. */
    pinned?: boolean;
};
export type DirectoryUser = {
    /** Merge key — lowercased primary email. */
    email: string;
    name?: string;
    sources: string[];
    externalIds?: Record<string, string>;
    active: boolean;
};
export type ProvisionedGrant = {
    email: string;
    provider: "nylas";
    grantRef?: string;
    status: EnterpriseGrantStatus;
    meta?: Record<string, unknown>;
};
export type EnterpriseOrg = {
    id?: string;
    name?: string;
};
export type EnterpriseState = {
    version: 1;
    syncedAt?: number;
    org?: EnterpriseOrg;
    connections: EnterpriseConnection[];
    roster: DirectoryUser[];
    grants: ProvisionedGrant[];
};
/** A minted (or static) access token for one connection. */
export type MintedToken = {
    accessToken: string;
    tokenType: string;
    /** Epoch ms. Static tokens use Number.MAX_SAFE_INTEGER. */
    expiresAt: number;
};
export declare const GOOGLE_DWD_DEFAULT_SCOPES: readonly ["https://mail.google.com/", "https://www.googleapis.com/auth/calendar", "https://www.googleapis.com/auth/contacts", "https://www.googleapis.com/auth/drive", "https://www.googleapis.com/auth/admin.directory.user.readonly"];
export declare const GOOGLE_ADMIN_DIRECTORY_READONLY_SCOPE = "https://www.googleapis.com/auth/admin.directory.user.readonly";
export declare const MS_GRAPH_DEFAULT_SCOPE = "https://graph.microsoft.com/.default";