/**
 * Shared wiring for backend-hosted images in provider requests.
 *
 * The backend serves conversation images from S3 behind
 * `GET /generated-images/<id>`, which is AUTH-GATED: an LLM provider
 * (OpenAI, Anthropic, OpenRouter, ...) fetching that url anonymously gets a
 * 401 and the image is silently dropped. `GET /generated-images/<id>/url`
 * — behind the machine JWT — returns a presigned S3 url that anyone can
 * fetch, so that is what we hand to the provider.
 *
 * `resolveBackendRouting()` supplies both the backend url and the machine
 * JWT. It is lazy (config + machine store are only read when a hosted image
 * is actually present) and memoized per resolver instance, and it degrades to
 * `null` when the CLI is not logged in — in which case every hook here is a
 * no-op and behaviour falls back to whatever it was before.
 *
 * @module @spectral/ai/utils/hosted-image-resolver
 */
export interface BackendHostedImageResolverOptions {
    /** Diagnostics sink — resolution failures are silent without it. */
    onWarn?: (message: string) => void;
    /**
     * Explicit backend base url (or a lazy getter for it). Wins over the url
     * from `resolveBackendRouting()`, so per-request overrides keep working;
     * used to resolve backend-relative image urls (`/generated-images/<id>`).
     */
    baseUrl?: string | (() => string | undefined | Promise<string | undefined>);
}
export interface BackendHostedImageResolver {
    /**
     * Swap a hosted url for a presigned one. Returns `null` when the url is
     * not resolvable (not logged in, foreign origin, backend error, ...) so
     * the caller can fall back to downloading + inlining the bytes itself.
     */
    resolveHostedUrl: (url: string, options?: {
        signal?: AbortSignal;
        timeoutMs?: number;
    }) => Promise<string | null>;
    /**
     * `Authorization: Bearer <machine JWT>` for downloading the image bytes
     * from our own backend. Only ever attached to hosted backend urls.
     */
    authHeaders: () => Promise<Record<string, string> | undefined>;
    /** Backend base url for resolving backend-relative image urls. */
    baseUrl: () => Promise<string | undefined>;
    /**
     * The backend url `resolveHostedUrl` authenticates against — i.e. the
     * origin an absolute image url has to match to be considered ours.
     * `undefined` when the CLI is not logged in (nothing is resolvable then).
     */
    backendUrl: () => Promise<string | undefined>;
}
/**
 * Build the hosted-image hooks for a single request.
 *
 * Cheap to construct: nothing is read from disk/config until one of the
 * returned functions is actually awaited.
 */
export declare function backendHostedImageResolver(options?: BackendHostedImageResolverOptions): BackendHostedImageResolver;
//# sourceMappingURL=hosted-image-resolver.d.ts.map