import type { GitHost } from "./git-hosts.js";
/** Tokens for the git hosts the Hook reads over HTTP (GitLab, gitboy). GitHub
 * goes through gh, which keeps its own sign-in.
 *
 * A token comes from, in order: the host's own environment variable, the
 * Hook's git-hosts.json (machine config like elevenlabs.json: mode 600, never
 * in the synced store), then the host's CLI where it has one (glab). The Hook
 * runs as a service that doesn't see shell env, so the file is the durable
 * source, written by `phren bridge git-host set` or the desktop's Connect. */
export type TokenHostKind = "gitlab" | "gitboy";
export type TokenSource = "environment" | "file" | "cli";
export interface HostToken {
    token: string;
    source: TokenSource;
    user?: string;
}
export declare function gitHostsFile(): string;
/** Store (or, with an empty token, forget) one domain's token. */
export declare function writeHostToken(domain: string, kind: TokenHostKind, token: string, user?: string, file?: string): Promise<void>;
export interface TokenLookup {
    env?: NodeJS.ProcessEnv;
    file?: string;
    cli?: boolean;
}
export declare function resolveHostToken(kind: TokenHostKind, domain: string, options?: TokenLookup): Promise<HostToken | undefined>;
/** Each stored domain with its kind and who it signs in as. Never a token. */
export declare function listHostTokens(file?: string): Promise<{
    domain: string;
    kind: TokenHostKind;
    user?: string;
    savedAt?: string;
}[] | "unsafe">;
/** Credential fingerprint only: raw credentials never enter lookup keys.
 * gh logout/switch-user rewrites hosts.yml even when its token is in a keychain. */
/** The lines of gh's hosts.yml under one host key (its user, protocol and any plain token). */
export declare function ghHostBlock(hostsYml: string, domain: string): string;
export declare function hostCredentialIdentity(host: GitHost): Promise<string>;