import type { Credential, CredentialRequest, CredentialResolver, CredentialResolverSource, OAuthCredentialStore, OAuthCredentials, OAuthProvider } from "./contracts.js";
export type CredentialValueSource = string | (() => string | undefined | Promise<string | undefined>) | CredentialResolver;
export interface CredentialRecord {
    readonly name: string;
    readonly provider?: string;
    readonly credential: Credential;
}
export interface MemoryCredentialStore extends CredentialResolver {
    set(record: CredentialRecord): void;
    delete(request: Pick<CredentialRequest, "name" | "provider">): boolean;
    clear(): void;
}
export interface MemoryCredentialStoreOptions {
    /** When true (default, backward compatible), a provider-scoped request falls back to a
     *  providerless record of the same name — that record is then served to EVERY provider.
     *  Set false for exact-match-only resolution (strict provider scoping). */
    readonly allowProviderFallback?: boolean;
}
export declare function createMemoryCredentialStore(initial?: readonly CredentialRecord[], options?: MemoryCredentialStoreOptions): MemoryCredentialStore;
export declare function createChainedCredentialResolver(resolvers: readonly CredentialResolver[]): CredentialResolver;
export declare function createExplicitCredentialResolver(sources: readonly CredentialResolverSource[]): CredentialResolver;
export declare function createEnvCredentialResolver(env: Readonly<Record<string, string | undefined>>, map: Readonly<Record<string, string>>): CredentialResolver;
export declare function refreshOAuthCredential(options: {
    readonly provider: OAuthProvider;
    readonly credentials: OAuthCredentials;
    readonly store?: OAuthCredentialStore;
}): Promise<OAuthCredentials>;
/** A credential store that can also remove entries (revocation fails closed on the delete). */
export interface RevocableOAuthCredentialStore extends OAuthCredentialStore {
    delete(provider: string, accountId?: string): Promise<boolean> | boolean;
}
/**
 * Revokes an OAuth credential: best-effort upstream revocation, then a mandatory local
 * store delete so subsequent connector calls fail closed. The local delete is the trust
 * boundary — an upstream revoke failure never leaves a stored token usable.
 */
export declare function revokeOAuthCredential(options: {
    readonly provider: OAuthProvider;
    readonly credentials: OAuthCredentials;
    readonly store?: RevocableOAuthCredentialStore;
}): Promise<void>;
export declare function resolveCredentialValue(source: CredentialValueSource | undefined, request: CredentialRequest): Promise<string | undefined>;