import { SecretRef, type SecretEntries } from './config.ts';
import type { ResolvedSecret, ResolvedSource } from './types.ts';
/**
 * Read one source-config value from its bootstrap source.
 *
 * Throws SecretsError naming the instance, the field and the source,
 * and nothing else, whether the fetch failed or the field is absent.
 * That is the boundary `fillEnv` draws and it is drawn for the same
 * reason: a dotenv miss renders the host path it looked for, and a
 * custom source shadowing `env` renders whatever it likes. The
 * source's own words ride the `cause` chain and are never logged: this
 * plane writes no log line at all, because a log is a copy nobody
 * redacted and a source is free to quote the value it was handed.
 */
export declare function configValue(label: string, ref: SecretRef, fetched: Map<string, ResolvedSecret>, sources?: Readonly<Record<string, ResolvedSource>>): Promise<string>;
/**
 * Whether a raw config value is a `{from, ref, key}` pointer.
 *
 * Strict: a plain mapping only counts when it parses as the pointer
 * grammar exactly, extra keys included, so an ordinary object-valued
 * config field that happens to carry a `from` is left alone.
 */
export declare function isConfigPointer(value: unknown): boolean;
/**
 * Whether a raw mount or CLI config names a secret anywhere inside.
 *
 * Read before any source is built, because building one reads its own
 * bootstrap pointers and a dotenv file is I/O. A config holding no
 * pointer must leave that I/O deferred to the first line that fills a
 * managed variable, or a declared source whose file is momentarily
 * unreadable stops the workspace from being created at all.
 */
export declare function configHoldsPointer(config: Readonly<Record<string, unknown>>): boolean;
/**
 * The declared instances, built only when one of `configs` names one.
 *
 * Every loader that builds a mount or a CLI from data comes through here
 * -- the config loader, a clone override, a load override -- because
 * building a source reads its own bootstrap pointers, and a dotenv file
 * is I/O. A config holding no pointer must leave that I/O deferred to
 * the first line that fills a managed variable, or a declared source
 * whose file is momentarily unreadable stops a workspace from being
 * created, or a clone from being made, that never needed it.
 *
 * `declared` is taken as it arrived: anything that is not a mapping is
 * left for the constructor to refuse with the wording every loader
 * shares. `undefined` still resolves a pointer at a builtin source,
 * which `fetchSecret` builds from ambient defaults.
 */
export declare function resolveSourcesFor(declared: unknown, configs: readonly Readonly<Record<string, unknown>>[]): Promise<Record<string, ResolvedSource> | undefined>;
/**
 * A raw mount or CLI config with every pointer read from its source.
 *
 * The same `configValue` a source's own config goes through, over the
 * config of a thing that reaches one. Resolved **before** the config is
 * parsed, so a credential stays the plain `string` its client already
 * reads and no VFS, accessor or backend learns this plane exists.
 *
 * One `fetched` cache spans the whole config, so two fields naming one
 * secret cost one call and cannot straddle a rotation.
 */
export declare function resolveConfigSecrets(config: Record<string, unknown>, sources?: Readonly<Record<string, ResolvedSource>>, label?: string): Promise<Record<string, unknown>>;
/**
 * Build every declared instance, reading its pointers.
 *
 * Runs once per workspace, before the first fetch, and reaches only
 * bootstrap sources -- the process env and dotenv files -- so a
 * declaration this cannot satisfy is a config error and rightly fails
 * every line, while a source that is merely unreachable still fails
 * only the names that want it.
 *
 * Takes the block parsed or raw, because the three callers hold
 * different things: the constructor parses eagerly so a bad
 * declaration fails there, the config loader and a clone override hand
 * over what they were given.
 *
 * Throws SecretsError for an unknown source, a missing bootstrap
 * field, or config the source's own model refuses. A refusal is
 * reported by field and reason only; the values are never in the
 * message.
 */
export declare function resolveSources(declared: Readonly<SecretEntries>): Promise<Record<string, ResolvedSource>>;
//# sourceMappingURL=sources.d.ts.map