/**
 * Vault key paths checked, in order. `github_token` is the fleet's canonical
 * flat name (the session-boot self-knowledge convention; deployed vaults use
 * it today); `github.token` is the nested dot-notation variant.
 */
export declare const GH_TOKEN_VAULT_KEYS: readonly ["github_token", "github.token"];
export interface ResolveGhTokenOptions {
    /** Test seam: route the master key to the file backend (never the real
     *  keychain). Production callers omit this. */
    forceFileKey?: boolean;
}
/**
 * Resolve the agent's GitHub token from the encrypted vault at
 * `<stateDir>/secrets/config.secrets.enc`.
 *
 * Returns the trimmed token string, or null when the vault is absent, holds
 * no GitHub token, or cannot be read. Never throws: session spawning must
 * proceed regardless of vault state.
 */
export declare function resolveGhTokenFromVault(stateDir: string, options?: ResolveGhTokenOptions): string | null;
//# sourceMappingURL=ghToken.d.ts.map