/**
 * @fileoverview Per-alias env-var resolution for `brapi_connect`.
 *
 * Aliases map to env-var prefixes via `BRAPI_<ALIAS>_*` (uppercased, hyphens →
 * underscores). Each alias can carry baseUrl + one credential family; the
 * connect handler layers agent input over alias env over default env over the
 * no-auth fallback. Credentials live in env, never in the LLM context.
 *
 * @module config/alias-credentials
 */
import type { AuthMode, ConnectAuth } from '../services/server-registry/index.js';
/**
 * Per-alias credential bundle read from env vars. All fields optional —
 * presence is what determines which auth mode is derived.
 */
export interface AliasCredentials {
    apiKey?: string;
    apiKeyHeader?: string;
    baseUrl?: string;
    bearerToken?: string;
    oauthClientId?: string;
    oauthClientSecret?: string;
    oauthTokenUrl?: string;
    password?: string;
    username?: string;
}
/** Compute the env-var prefix for an alias. `my-server` → `BRAPI_MY_SERVER_`. */
export declare function aliasEnvPrefix(alias: string): string;
/** Read all `BRAPI_<ALIAS>_*` vars for an alias. Empty strings treated as unset. */
export declare function readAliasCredentials(alias: string, env?: NodeJS.ProcessEnv): AliasCredentials;
/**
 * Pick a `ConnectAuth` from the credential bundle. Returns `undefined` when no
 * credentials are present so callers can fall through to the next layer.
 * Throws on intra-alias ambiguity (multiple credential families set).
 */
export declare function deriveAuthFromCredentials(creds: AliasCredentials, alias: string): ConnectAuth | undefined;
export interface ResolvedConnectInput {
    auth: ConnectAuth;
    baseUrl: string;
}
/**
 * Layer agent input over alias env over the builtin registry over default env.
 * Returns the resolved baseUrl + auth. Throws when no baseUrl is resolvable
 * from any layer.
 *
 * Precedence:
 *   1. Explicit agent input (`baseUrl`, `auth`) wins.
 *   2. Per-alias env vars (`BRAPI_<ALIAS>_*`).
 *   3. Built-in known-server registry — see `config/builtin-aliases.ts`.
 *   4. Default env vars (`BRAPI_DEFAULT_*`) — only when alias differs.
 *   5. `auth` falls through to `{ mode: 'none' }`; `baseUrl` has no fallback.
 *
 * When the baseUrl is satisfied by a builtin, default-env auth is NOT used —
 * default credentials belong to the default server, not whatever upstream the
 * builtin happens to point at. Per-alias creds still apply, since those were
 * explicitly set for this alias.
 */
export declare function resolveConnectInput(alias: string, agent: {
    baseUrl?: string | undefined;
    auth?: ConnectAuth | undefined;
}, env?: NodeJS.ProcessEnv): ResolvedConnectInput;
/**
 * Summary of an alias the agent can call out-of-the-box. Either pre-wired by
 * the operator via `BRAPI_<ALIAS>_BASE_URL` (`origin: 'env'`) or shipped in the
 * built-in known-server registry (`origin: 'builtin'`). Surfaced to the LLM
 * via the connect tool description so agents can pick a shortcut without the
 * human having to enumerate them.
 */
export interface DiscoveredAlias {
    alias: string;
    authMode: AuthMode;
    baseUrl: string;
    origin: 'env' | 'builtin';
}
/**
 * Inventory of aliases the agent can call without specifying a baseUrl. Merges
 * env-driven entries (operator-set `BRAPI_<X>_BASE_URL`) with the built-in
 * known-server registry. Env-set aliases win when both are present, since the
 * resolver gives env precedence; their `origin` reflects that. Per-alias
 * credentials still derive auth in either case, so a builtin alias with
 * `BRAPI_<ALIAS>_USERNAME` set surfaces with the right `authMode`.
 *
 * Default-alias entries land first; the rest are alphabetical.
 */
export declare function discoverConfiguredAliases(env?: NodeJS.ProcessEnv): DiscoveredAlias[];
/**
 * Render the discovered alias list as a sentence appended to the connect
 * tool's description. Empty when nothing is configured. Splits builtins from
 * env-driven aliases so the LLM understands which work out-of-the-box vs
 * which the operator pre-wired. Phrased so that absent aliases are never read
 * as restricted servers: any BrAPI v2 URL stays connectable.
 */
export declare function formatConfiguredAliasesHint(aliases: DiscoveredAlias[]): string;
//# sourceMappingURL=alias-credentials.d.ts.map