import { SecretValue as SecretValue$1 } from "../secret-value.js";
import { ParsedSecretRef } from "../secret-ref.js";
import { SecretRef, SecretResolver, SecretResolverContext } from "@graphorin/core/contracts";

//#region src/secrets/resolvers/registry.d.ts

/**
 * Options for `registerResolver(...)`.
 *
 * @stable
 */
interface RegisterResolverOptions {
  /** When false, throws if a resolver is already registered. Default true. */
  readonly allowReplace?: boolean;
  /** Internal flag - used by the built-in resolvers; consumers leave this off. */
  readonly source?: 'builtin' | 'user';
}
/**
 * Register a resolver for a single scheme. Last registration wins by
 * default, matching the documented "pluggable resolver" contract; pass
 * `{ allowReplace: false }` to force strict registration semantics.
 *
 * @stable
 */
declare function registerResolver(resolver: SecretResolver, opts?: RegisterResolverOptions): SecretResolver | undefined;
/**
 * Look up the resolver registered for `scheme`. Returns `undefined` if
 * no resolver matches.
 *
 * @stable
 */
declare function getResolver(scheme: string): SecretResolver | undefined;
/**
 * List the schemes for which a resolver is registered. Useful for
 * `validateSecretRefs(...)` and CLI diagnostics.
 *
 * @stable
 */
declare function listResolverSchemes(): ReadonlyArray<string>;
/**
 * Remove a registered resolver. Returns `true` if a resolver was
 * removed. Tests use this to isolate fixtures.
 *
 * @stable
 */
declare function unregisterResolver(scheme: string): boolean;
/**
 * Reset the registry to a freshly-installed built-in state. Tests use
 * this between cases.
 *
 * @experimental
 */
declare function _resetResolversForTesting(): void;
/**
 * Whether the built-in resolver set has been installed in the current
 * registry. The factory and `validateSecretRefs(...)` use this to
 * surface the "did you forget to import @graphorin/security?" failure
 * early.
 *
 * @internal
 */
declare function areBuiltinsInstalled(): boolean;
/**
 * Resolve a `SecretRef` (string or parsed) into a `SecretValue` via
 * the active resolver. Throws `UnknownSchemeError` if no resolver
 * matches; rewraps non-typed errors thrown by the resolver into a
 * `SecretResolutionError` so consumers always see a stable error
 * surface.
 *
 * @stable
 */
declare function resolveSecret(ref: string | ParsedSecretRef | SecretRef, ctx?: SecretResolverContext): Promise<SecretValue$1>;
//#endregion
export { RegisterResolverOptions, _resetResolversForTesting, areBuiltinsInstalled, getResolver, listResolverSchemes, registerResolver, resolveSecret, unregisterResolver };
//# sourceMappingURL=registry.d.ts.map