import type { FabricActor } from './types.js';
import type { SecretRef } from './tools.js';
export interface SecretResolutionContext {
    sessionId?: string;
    tenantId?: string;
    actor?: FabricActor;
    signal?: AbortSignal;
}
export interface SecretProvider {
    readonly name: string;
    resolve(ref: SecretRef, context?: SecretResolutionContext): string | undefined | Promise<string | undefined>;
}
export interface EnvironmentSecretProviderOptions {
    env?: Record<string, string | undefined>;
    prefix?: string;
    allow?: readonly string[];
}
/** Runtime-only environment provider with optional prefix and explicit allowlist. */
export declare function environmentSecretProvider(options?: EnvironmentSecretProviderOptions): SecretProvider;
/** Resolve from providers in order; errors fail closed instead of falling through. */
export declare function chainSecretProviders(...providers: Array<SecretProvider | undefined>): SecretProvider;
/** Adapt a provider to the existing `init({ resolveSecret })` callback. */
export declare function secretResolver(provider: SecretProvider, context?: SecretResolutionContext): (ref: SecretRef) => Promise<string | undefined>;
//# sourceMappingURL=secret-provider.d.ts.map