import type { Token } from '@frontmcp/di';
import type { NormalizedToolAuthProvider } from '../../common/metadata/tool.metadata';
/** Outcome for a single required provider whose credential is unavailable. */
export interface MissingProvider {
    /** Provider id (the credential key / registered provider name). */
    name: string;
    /** Best-effort connect/authorize URL to (re)authorize, if resolvable. */
    authUrl?: string;
}
/** Result of evaluating the credential gate for a tool. */
export interface CredentialGateResult {
    /**
     * `true` when a credential accessor was available and the providers were
     * actually evaluated; `false` when no accessor is configured (gate skipped).
     */
    evaluated: boolean;
    /** Required providers whose credential was not available. */
    missing: MissingProvider[];
}
/**
 * Evaluate the credential gate for a tool's normalized auth providers.
 *
 * @param providers - normalized auth-provider refs (defaults already applied).
 * @param tryGet - defensive DI resolver (e.g. the tool context's `tryGet`) that
 *   returns `undefined` (rather than throwing) when a token is not registered
 *   or is out of scope. This lets the gate transparently skip when no
 *   credential accessor is wired.
 * @returns whether the gate was evaluated and which required providers are missing.
 */
export declare function evaluateToolCredentialGate(providers: NormalizedToolAuthProvider[], tryGet: <T>(token: Token<T>) => T | undefined): Promise<CredentialGateResult>;
//# sourceMappingURL=tool-credentials.gate.d.ts.map