import { JwtVerifyResult } from "./jwt-helpers.js";
import { z } from "zod";

//#region src/utils/slack-user-token.d.ts

/**
 * Zod schema for validating Slack user access token JWT payload.
 * This is the canonical schema from the work_apps_slack spec.
 */
declare const SlackAccessTokenPayloadSchema: z.ZodObject<{
  iss: z.ZodLiteral<"inkeep-auth">;
  aud: z.ZodLiteral<"inkeep-api">;
  sub: z.ZodString;
  iat: z.ZodNumber;
  exp: z.ZodNumber;
  jti: z.ZodOptional<z.ZodString>;
  tokenUse: z.ZodLiteral<"slackUser">;
  act: z.ZodObject<{
    sub: z.ZodLiteral<"inkeep-work-app-slack">;
  }, z.core.$strip>;
  tenantId: z.ZodString;
  slack: z.ZodObject<{
    teamId: z.ZodString;
    userId: z.ZodString;
    enterpriseId: z.ZodOptional<z.ZodString>;
    email: z.ZodOptional<z.ZodString>;
    authorized: z.ZodOptional<z.ZodBoolean>;
    authSource: z.ZodOptional<z.ZodEnum<{
      channel: "channel";
      workspace: "workspace";
    }>>;
    channelId: z.ZodOptional<z.ZodString>;
    authorizedProjectId: z.ZodOptional<z.ZodString>;
  }, z.core.$strip>;
}, z.core.$strip>;
type SlackAccessTokenPayload = z.infer<typeof SlackAccessTokenPayloadSchema>;
/**
 * Parameters for generating a Slack user token
 */
interface SignSlackUserTokenParams {
  inkeepUserId: string;
  tenantId: string;
  slackTeamId: string;
  slackUserId: string;
  slackEnterpriseId?: string;
  slackEmail?: string;
  slackAuthorized?: boolean;
  slackAuthSource?: 'channel' | 'workspace';
  slackChannelId?: string;
  slackAuthorizedProjectId?: string;
}
/**
 * Result of verifying a Slack user token
 */
type VerifySlackUserTokenResult = JwtVerifyResult<SlackAccessTokenPayload>;
/**
 * Sign a Slack user JWT token for calling Manage/Run APIs.
 * Token expires in 5 minutes.
 *
 * This token is used when Slack runtime logic needs to call:
 * - Manage API (list projects, list agents)
 * - Run API (POST /run/api/chat)
 */
declare function signSlackUserToken(params: SignSlackUserTokenParams): Promise<string>;
/**
 * Verify and decode a Slack user JWT token.
 * Validates signature, expiration, issuer, audience, and schema.
 */
declare function verifySlackUserToken(token: string): Promise<VerifySlackUserTokenResult>;
/**
 * Check if a token looks like a Slack user JWT (quick check before full verification).
 * Returns true if the token has the expected issuer and tokenUse.
 */
declare function isSlackUserToken(token: string): boolean;
//#endregion
export { SignSlackUserTokenParams, SlackAccessTokenPayload, SlackAccessTokenPayloadSchema, VerifySlackUserTokenResult, isSlackUserToken, signSlackUserToken, verifySlackUserToken };