import { SecretRef, AgentAccessAuthToken } from './types.js';
import './index-1qIcnbG1.js';

/**
 * Resolve `agentAccessHttp.authToken` (issue #757).
 *
 * Two shapes are accepted:
 *
 *   1. Plain string — returned unchanged. This is the only shape supported
 *      in standalone Remnic; it preserves backward compatibility with every
 *      pre-#757 config.
 *
 *   2. SecretRef-like object (`{source, provider?, id?, command?, ...}`) —
 *      resolved only through a resolver supplied by the host adapter. Core
 *      stays host-agnostic and never scans OpenClaw, Hermes, or any other
 *      runtime directly.
 *
 * Resolution flow for SecretRef objects:
 *
 *   - Plain strings short-circuit before any host work.
 *   - Host adapters pass their native SecretRef resolver in `options`.
 *   - If no resolver is provided, throw a clear, actionable error rather
 *     than silently leaving the bridge open or starting with no auth.
 *
 * Lessons baked in from PRs #316–#319:
 *
 *   - Successful resolutions are cached for the process lifetime; failures
 *     are not cached so transient issues (Keychain unlocked late, agent
 *     restarts) recover automatically.
 */
type ResolveSecretRefFn = (ref: SecretRef, context?: unknown) => Promise<string | undefined> | string | undefined;
type ResolveAgentAccessAuthTokenOptions = {
    resolveSecretRef?: ResolveSecretRefFn | null;
};
/**
 * Resolve an `agentAccessHttp.authToken` value to a literal bearer string.
 *
 * @returns the resolved string, or `undefined` if input was undefined/empty.
 * @throws if the input is a SecretRef and no resolver is provided, if the
 *         resolver returns no value, or if the input shape is malformed.
 */
declare function resolveAgentAccessAuthToken(value: AgentAccessAuthToken | undefined, options?: ResolveAgentAccessAuthTokenOptions): Promise<string | undefined>;
/**
 * Returns true if the value is a SecretRef object (issue #757). Useful for
 * surfaces (CLI flags, doctor checks) that want to render a redacted
 * placeholder instead of leaking the unresolved object shape.
 */
declare function isAgentAccessSecretRef(value: unknown): value is SecretRef;
/** Test/operations hook: drop the cache and force resolver rediscovery. */
declare function clearAuthTokenSecretCache(): void;

export { type ResolveSecretRefFn, clearAuthTokenSecretCache, isAgentAccessSecretRef, resolveAgentAccessAuthToken };
