import type { RemoteAgentAuth } from "../resources/metadata.js";
export type RemoteAgentAuthErrorCode = "credential_missing" | "credential_rejected" | "invalid_auth" | "token_request_failed";
export declare class RemoteAgentAuthError extends Error {
    readonly code: RemoteAgentAuthErrorCode;
    /** `code` under the field run and action errors carry to the client. */
    readonly errorCode: RemoteAgentAuthErrorCode;
    readonly statusCode?: number;
    readonly credentialRef?: string;
    readonly tokenUrl?: string;
    constructor(options: {
        code: RemoteAgentAuthErrorCode;
        message: string;
        statusCode?: number;
        credentialRef?: string;
        tokenUrl?: string;
        cause?: unknown;
    });
}
export declare class RemoteAgentCredentialRejectedError extends RemoteAgentAuthError {
    readonly status: 401 | 403;
    constructor(options: {
        status: 401 | 403;
        credentialRef?: string;
        tokenUrl?: string;
    });
}
export interface RemoteAgentCredentialContext {
    userEmail?: string;
    orgId?: string | null;
}
export declare function clearRemoteAgentTokenCache(): void;
/**
 * Resolve the configured auth reference for a connected hosted agent.
 *
 * The manifest carries only vault reference names. Values are resolved inside
 * the current request's user/org scope and never read from process.env.
 */
export declare function resolveRemoteAgentToken(auth: RemoteAgentAuth | undefined, context?: RemoteAgentCredentialContext): Promise<string | undefined>;