/**
 * Source store for orchestrator webhook source management.
 *
 * Provides CRUD operations for the sources table with secret storage
 * via PgSecretStore. Secrets (private keys, webhook secrets) are stored
 * separately from the source config to leverage the existing encryption
 * infrastructure.
 */
import { type Kysely } from 'kysely';
import type { Database, Source } from '../db/types.js';
import type { PgSecretStore } from '../secrets/pg-secret-store.js';
/**
 * Parameters for adding a new source.
 */
export interface AddSourceParams {
    /** Provider type (e.g. 'github') */
    provider: string;
    /** Human-readable source name */
    name: string;
    /** App ID for the provider (used to build routing key) */
    appId: string;
    /** Private key (PEM format for GitHub Apps) */
    privateKey: string;
    /** Webhook secret for signature verification */
    webhookSecret?: string;
    /** Extra non-sensitive config */
    config?: Record<string, unknown>;
    /** Customer/org identifier for secret and environment scoping */
    customerId?: string;
}
/**
 * A source with its decrypted secrets.
 */
export interface SourceWithSecrets extends Source {
    privateKey: string;
    webhookSecret?: string;
}
/**
 * CRUD store for webhook sources backed by PostgreSQL.
 * Sensitive credentials are stored in PgSecretStore under `__source__/<id>`.
 */
export declare class SourceStore {
    private readonly db;
    private readonly secretStore;
    constructor(db: Kysely<Database>, secretStore: PgSecretStore);
    /**
     * Add a new source. Stores config in sources table, secrets in PgSecretStore.
     * Routing key is computed as `<provider>:<appId>`.
     */
    addSource(params: AddSourceParams): Promise<Source>;
    /**
     * List all sources (no secrets exposed).
     */
    listSources(): Promise<Source[]>;
    /**
     * Get a single source by routing key, or null if not found.
     */
    getSource(routingKey: string): Promise<Source | null>;
    /**
     * Get a source with its decrypted secrets.
     */
    getSourceWithSecrets(routingKey: string): Promise<SourceWithSecrets | null>;
    /**
     * Update a source's name/config and optionally rotate secrets.
     */
    updateSource(routingKey: string, updates: {
        name?: string;
        privateKey?: string;
        webhookSecret?: string;
        config?: Record<string, unknown>;
        /** New customer/org identifier (used for secret + environment scoping). */
        customerId?: string;
    }): Promise<Source>;
    /**
     * Remove a source and its associated secrets.
     */
    removeSource(routingKey: string): Promise<void>;
}
//# sourceMappingURL=source-store.d.ts.map