import { ForgeZero } from './index';
import { type ProviderInstanceConfig, type ServiceMethodAttachment, type ConfigSource } from '@forgezero/providers';
export type StoredProviderInstance = ProviderInstanceConfig;
export type StoredServiceMethodAttachment = ServiceMethodAttachment;
export interface VaultConfigOptions {
    /**
     * Entry containing provider identities, independent of services.
     *
     * Overridable because a tenant already using `providers.*` for something else
     * should not have to rename it to adopt this.
     */
    providersEntry?: string;
    /** Entry containing one service method's ordered attachments. */
    serviceEntryFor?: (serviceKey: string, methodKey: string) => string;
}
/**
 * Read the ordered provider list for a service out of the vault.
 *
 * A missing entry is an EMPTY LIST, not an error. A service nobody has
 * configured yet is a normal state — the registry then falls through to
 * an explicitly configured alternative. Managed Vault credentials never fall
 * through to bootstrap credentials.
 *
 * A malformed entry is NOT empty. Silently treating unparseable JSON as "no
 * providers" turns a typo into a service that appears configured and quietly
 * sends nothing.
 */
export declare function vaultConfig(vault: ForgeZero, options?: VaultConfigOptions): ConfigSource;
/**
 * Credentials out of the vault, by the reference a provider config names.
 *
 * `secretRef: 'jetemail'` plus field `token` reads the entry `jetemail.token`.
 * The reference is stored on the provider row and the secret is not, so a dump
 * of the configuration yields the NAMES of secrets and none of their values.
 */
export declare function vaultCredentials(vault: ForgeZero): {
    name: string;
    get(reference: string, field: string): Promise<string>;
};
export declare function vaultCredentials(vault: ForgeZero, reference: string): {
    name: string;
    get(field: string): Promise<string>;
};