import { I as IntegrationActor, e as IntegrationConnectorAction, g as IntegrationDataClass, k as IntegrationActionGuard, c as IntegrationConnection, l as IntegrationActionRequest, b as IntegrationConnector, m as IntegrationActionResult } from './core-types-DMDmeutI.js';
import { IntegrationSandboxBundle, IntegrationRequirementMode, IntegrationRequirementResolution, IntegrationManifest, IntegrationManifestResolution, IntegrationGrant } from './runtime.js';
import { IntegrationRegistry } from './registry.js';

type IntegrationAuditEventType = 'connection.created' | 'connection.updated' | 'connection.revoked' | 'grant.created' | 'grant.revoked' | 'capability.issued' | 'action.invoked' | 'action.failed' | 'trigger.subscribed' | 'trigger.received' | 'workflow.installed' | 'approval.requested' | 'approval.resolved' | 'healthcheck.completed';
interface IntegrationAuditEvent {
    id: string;
    type: IntegrationAuditEventType;
    occurredAt: string;
    actor?: IntegrationActor;
    connectionId?: string;
    providerId?: string;
    connectorId?: string;
    action?: string;
    risk?: IntegrationConnectorAction['risk'];
    dataClass?: IntegrationDataClass;
    ok?: boolean;
    message?: string;
    metadata?: Record<string, unknown>;
}
interface IntegrationAuditSink {
    record(event: IntegrationAuditEvent): Promise<void> | void;
}
interface IntegrationAuditStore extends IntegrationAuditSink {
    list(filter?: IntegrationAuditFilter): Promise<IntegrationAuditEvent[]> | IntegrationAuditEvent[];
}
interface IntegrationAuditFilter {
    type?: IntegrationAuditEventType;
    actor?: IntegrationActor;
    connectionId?: string;
    providerId?: string;
    connectorId?: string;
    action?: string;
}
declare class InMemoryIntegrationAuditStore implements IntegrationAuditStore {
    private readonly events;
    record(event: IntegrationAuditEvent): void;
    list(filter?: IntegrationAuditFilter): IntegrationAuditEvent[];
}
declare function createIntegrationAuditEvent(input: Omit<IntegrationAuditEvent, 'id' | 'occurredAt'> & {
    id?: string;
    occurredAt?: string | Date;
    now?: () => Date;
}): IntegrationAuditEvent;
declare function createAuditingActionGuard(options: {
    sink: IntegrationAuditSink;
    subject?: IntegrationActor;
    now?: () => Date;
    includeInputPreview?: boolean;
}): IntegrationActionGuard;
declare function sanitizeAuditConnection(connection: IntegrationConnection): Record<string, unknown>;

type IntegrationHealthcheckStatus = 'healthy' | 'degraded' | 'unhealthy' | 'unknown';
interface IntegrationHealthcheckCheck {
    id: string;
    status: IntegrationHealthcheckStatus;
    message: string;
    metadata?: Record<string, unknown>;
}
interface IntegrationHealthcheckResult {
    connectionId: string;
    providerId: string;
    connectorId: string;
    status: IntegrationHealthcheckStatus;
    checkedAt: string;
    checks: IntegrationHealthcheckCheck[];
    metadata?: Record<string, unknown>;
}
interface IntegrationHealthcheckStore {
    put(result: IntegrationHealthcheckResult): Promise<void> | void;
    get(connectionId: string): Promise<IntegrationHealthcheckResult | undefined> | IntegrationHealthcheckResult | undefined;
    list(): Promise<IntegrationHealthcheckResult[]> | IntegrationHealthcheckResult[];
}
declare class InMemoryIntegrationHealthcheckStore implements IntegrationHealthcheckStore {
    private readonly results;
    put(result: IntegrationHealthcheckResult): void;
    get(connectionId: string): IntegrationHealthcheckResult | undefined;
    list(): IntegrationHealthcheckResult[];
}
declare function runIntegrationHealthcheck(input: {
    connection: IntegrationConnection;
    connector?: IntegrationConnector;
    registry?: IntegrationRegistry;
    test?: (connection: IntegrationConnection, connector: IntegrationConnector) => Promise<IntegrationActionResult | boolean> | IntegrationActionResult | boolean;
    audit?: IntegrationAuditSink;
    now?: () => Date;
}): Promise<IntegrationHealthcheckResult>;
declare function runIntegrationHealthchecks(input: {
    connections: IntegrationConnection[];
    registry?: IntegrationRegistry;
    store?: IntegrationHealthcheckStore;
    audit?: IntegrationAuditSink;
    now?: () => Date;
    test?: (connection: IntegrationConnection, connector: IntegrationConnector) => Promise<IntegrationActionResult | boolean> | IntegrationActionResult | boolean;
}): Promise<IntegrationHealthcheckResult[]>;
declare function healthcheckRequest(action?: string): IntegrationActionRequest;

/**
 * @stable Integration Hub consumer client.
 *
 * The third client-shaped surface a product needs, alongside the two that
 * already ship:
 *
 *   - `createTangleIntegrationsClient` (`client.ts`) — the *invoke* client.
 *     Capability-token auth, runs INSIDE a sandbox / generated app, single
 *     endpoint `/v1/integrations/invoke`.
 *   - `startConnectFlow` / `finishConnectFlow` (`connect/index.ts`) — the
 *     *user-consent* flow, mirrors `/cross-site/*`.
 *   - **this** — the S2S *management* client. A product BACKEND (blueprint-
 *     agent, sandbox, gtm-agent, tax-agent, legal-agent, evals, …) drives the
 *     `/v1/integrations/{resolve-manifest,grants,capabilities/bundle,
 *     healthchecks/run}` management surface on `id.tangle.tools` on behalf of
 *     an identified user.
 *
 * Every consumer needs the identical client — the wire protocol, the
 * `{ success, data }` envelope, the auth header shape are all platform-owned.
 * Re-implementing a bespoke fetch loop per product forks the protocol and the
 * copies drift. This module is that shared implementation. It mirrors the
 * `connect/index.ts` design rule one-for-one: DO NOT invent the wire protocol
 * — speak exactly what `products/platform/api/src/routes/integrations.ts`
 * serves.
 *
 * Two auth modes — the route layer (`authMiddleware`) accepts either:
 *
 *   - `service`  — a `svc_*` service token + `X-Service-Name`. The acting
 *     user travels in `X-Platform-User-Id`. The platform honors that header
 *     only for service tokens whose `SERVICE_SCOPES` set contains
 *     `impersonate:user`; a token without it is rejected (403). Reaches the
 *     four management paths the platform allowlists for service tokens.
 *   - `user-key` — a per-user `sk-tan-*` API key (minted via the connect
 *     flow). The key identifies the user; no impersonation header. Reaches
 *     every route the user themselves can.
 *
 * The capability-token `invoke` endpoint is intentionally NOT exposed here —
 * that is `createTangleIntegrationsClient`'s job and uses a different auth.
 */

type IntegrationHubAuth = {
    mode: 'service';
    /** The `svc_*` token issued to this product. */
    serviceToken: string;
    /** Registered service name — sent as `X-Service-Name`. Required
     *  because one token may be shared across services, in which case the
     *  platform demands the header to disambiguate. */
    serviceName: string;
} | {
    mode: 'user-key';
    /** A per-user `sk-tan-*` key bound to the acting user. */
    apiKey: string;
};
interface IntegrationHubClientOptions {
    /** The product / consumer identifier (e.g. `blueprint-agent`). Sent as the
     *  `product` field of resolve-manifest calls; recorded platform-side. */
    product: string;
    /** Service-token or per-user-key auth. */
    auth: IntegrationHubAuth;
    /** Platform base URL. Defaults to `https://id.tangle.tools`. */
    endpoint?: string;
    /** Injected for tests. Defaults to the global `fetch`. */
    fetchImpl?: typeof fetch;
    /** Per-request timeout in ms. Default 10_000. */
    timeoutMs?: number;
    /** Max attempts on transient (network / 502 / 503 / 504) failures.
     *  Default 2 — i.e. one retry. */
    maxAttempts?: number;
}
/** Thrown for every non-2xx response and every transport failure. Carries the
 *  HTTP status and the platform error code so callers can branch precisely
 *  (`403` + `impersonate` → the service token lacks the scope; `409` /
 *  `missing_connection` → prompt the user to connect). */
declare class IntegrationHubRequestError extends Error {
    readonly name = "IntegrationHubRequestError";
    /** HTTP status, or 0 for a network-level failure. */
    readonly status: number;
    /** Platform error code (`VALIDATION_ERROR`, `scope_missing`, …) or
     *  `network_error` / `http_error` when no structured code was returned. */
    readonly code: string;
    /** `METHOD /path` the request targeted. */
    readonly endpoint: string;
    /** True when the failure class is transient and a retry could succeed. */
    readonly retryable: boolean;
    constructor(input: {
        status: number;
        code: string;
        message: string;
        endpoint: string;
        retryable: boolean;
    });
}
interface ResolveManifestInput {
    /** The acting user — the connection owner. */
    userId: string;
    manifest: IntegrationManifest;
    /** Overrides the client-level `product` for this call. */
    product?: string;
}
interface CreateGrantsInput {
    /** The acting user — the connection owner. */
    userId: string;
    /** Who the grant is FOR (the sandbox / agent / app that will invoke). */
    grantee: IntegrationActor;
    manifest: IntegrationManifest;
    metadata?: Record<string, unknown>;
}
interface ListGrantsInput {
    /** The acting user — the connection owner. */
    userId: string;
    /** Optional grantee filter; both fields travel together as query params. */
    grantee?: IntegrationActor;
}
interface MintCapabilityBundleInput {
    /** The acting user — must own every connection behind the grants. */
    userId: string;
    /** Who the capability bundle is issued TO (the sandbox / agent process). */
    subject: IntegrationActor;
    /** Mint from every grant of a manifest … */
    manifestId?: string;
    /** … or from an explicit grant id list. Exactly one of the two is required. */
    grantIds?: string[];
    grantee?: IntegrationActor;
    /** Bundle TTL in ms. Platform clamps to [1s, 60m]; default 15m. */
    ttlMs?: number;
}
interface CapabilityBundleResult {
    bundle: IntegrationSandboxBundle;
    /** Bridge environment variables to inject into the sandbox process —
     *  `buildIntegrationBridgeEnvironment(bundle)`, computed platform-side. */
    env: Record<string, string>;
}
interface CheckConnectorInput {
    /** The acting user. */
    userId: string;
    /** Connector to probe — `github`, `google-calendar`, `tangle-id`, … */
    connectorId: string;
    /** Defaults to `read`. */
    mode?: IntegrationRequirementMode;
    requiredScopes?: string[];
    requiredActions?: string[];
}
interface CheckConnectorResult {
    /** True when the user has an active connection satisfying the requirement. */
    connected: boolean;
    /** The satisfying connection, present iff `connected`. */
    connection?: IntegrationConnection;
    /** The full requirement resolution — status, missing scopes/actions, message. */
    resolution: IntegrationRequirementResolution;
}
/**
 * S2S management client for the `id.tangle.tools` integration hub. One per
 * product; methods are stateless and safe to call concurrently.
 */
declare class IntegrationHubClient {
    private readonly endpoint;
    private readonly product;
    private readonly auth;
    private readonly fetchImpl;
    private readonly timeoutMs;
    private readonly maxAttempts;
    constructor(options: IntegrationHubClientOptions);
    /**
     * Resolve a manifest against a user's connections. The returned
     * `ready` / `missing` split is the canonical way to ask "does this user
     * have the connections this work needs" — the raw connection list is not
     * reachable by a service token by design.
     */
    resolveManifest(input: ResolveManifestInput): Promise<IntegrationManifestResolution>;
    /**
     * Convenience over {@link resolveManifest} — probe a single connector and
     * get back a boolean plus the satisfying connection. The Surface-A quest
     * primitive ("is the user's GitHub linked?").
     */
    checkConnector(input: CheckConnectorInput): Promise<CheckConnectorResult>;
    /** Create grants for every satisfiable requirement of a manifest. The
     *  platform rejects the call if any non-optional requirement is missing a
     *  connection. */
    createGrants(input: CreateGrantsInput): Promise<IntegrationGrant[]>;
    /** List the acting user's grants, optionally filtered to one grantee. */
    listGrants(input: ListGrantsInput): Promise<IntegrationGrant[]>;
    /** Mint a short-lived capability bundle for a sandbox / agent process.
     *  Provider credentials never leave the platform — the bundle carries only
     *  scoped, expiring capability tokens. */
    mintCapabilityBundle(input: MintCapabilityBundleInput): Promise<CapabilityBundleResult>;
    /** Run live healthchecks across all of the acting user's connections. */
    runHealthchecks(input: {
        userId: string;
    }): Promise<IntegrationHealthcheckResult[]>;
    private buildHeaders;
    private request;
}
declare function createIntegrationHubClient(options: IntegrationHubClientOptions): IntegrationHubClient;

export { type CapabilityBundleResult as C, type IntegrationAuditSink as I, type ListGrantsInput as L, type MintCapabilityBundleInput as M, type ResolveManifestInput as R, type CheckConnectorInput as a, type CheckConnectorResult as b, type CreateGrantsInput as c, InMemoryIntegrationAuditStore as d, InMemoryIntegrationHealthcheckStore as e, type IntegrationAuditEvent as f, type IntegrationAuditEventType as g, type IntegrationAuditFilter as h, type IntegrationAuditStore as i, type IntegrationHealthcheckCheck as j, type IntegrationHealthcheckResult as k, type IntegrationHealthcheckStatus as l, type IntegrationHealthcheckStore as m, type IntegrationHubAuth as n, IntegrationHubClient as o, type IntegrationHubClientOptions as p, IntegrationHubRequestError as q, createAuditingActionGuard as r, createIntegrationAuditEvent as s, createIntegrationHubClient as t, healthcheckRequest as u, runIntegrationHealthcheck as v, runIntegrationHealthchecks as w, sanitizeAuditConnection as x };
