import type { CredentialRef } from "./credentialRef.js";
import { type RedactedString } from "./secretRedaction.js";
export type AuthEnvelopeKind = "bearer" | "api-key" | "oauth" | "none";
export type AuthHeaderPlan = {
    name: string;
    value: string | RedactedString;
    redacted: true;
};
export type AuthQueryPlan = {
    name: string;
    value: string | RedactedString;
    redacted: true;
};
export type AuthEnvelope = {
    kind: AuthEnvelopeKind;
    present: boolean;
    credentialRef?: CredentialRef;
    redactedIdentity?: string;
    headerPlan: readonly AuthHeaderPlan[];
    queryPlan: readonly AuthQueryPlan[];
    expiresAt?: string;
    publicSafe: true;
};
export type ProviderAuthMaterial = {
    headers?: Readonly<Record<string, string>>;
    query?: Readonly<Record<string, string>>;
    expiresAt?: string;
};
export type ResolvedAuthEnvelope = {
    envelope: AuthEnvelope;
    privateMaterial?: ProviderAuthMaterial;
};
export declare function createMissingAuthEnvelope(credentialRef?: CredentialRef, reason?: string): AuthEnvelope;
export declare function createBearerAuthEnvelope(input: {
    credentialRef: CredentialRef;
    token: string;
    redactedIdentity?: string;
    expiresAt?: string;
    extraHeaders?: Readonly<Record<string, string>>;
}): ResolvedAuthEnvelope;
export declare function createApiKeyAuthEnvelope(input: {
    credentialRef: CredentialRef;
    apiKey: string;
    redactedIdentity?: string;
    headerName?: string;
    extraHeaders?: Readonly<Record<string, string>>;
}): ResolvedAuthEnvelope;
export declare function toPublicAuthEnvelope(resolved: ResolvedAuthEnvelope | AuthEnvelope): AuthEnvelope;
export declare function mergeAuthMaterialHeaders(authMaterial: ProviderAuthMaterial | undefined, headers: Readonly<Record<string, string>> | undefined): Readonly<Record<string, string>>;
