import { ParsedSecretRef } from "../secret-ref.js";
import { SecretResolver, SecretResolverContext, SecretValue } from "@graphorin/core/contracts";

//#region src/secrets/resolvers/vault.d.ts

/**
 * Concrete adapter signature plugged into `setVaultAdapter(...)`. The
 * built-in resolver only ships the **pattern** - a real Vault adapter
 * lives in the optional `@graphorin/secret-vault` package (post-MVP).
 *
 * @stable
 */
type VaultAdapter = (ref: ParsedSecretRef, ctx: SecretResolverContext | undefined) => Promise<SecretValue>;
/**
 * Register a runtime adapter for the `vault://` scheme. Calling this
 * twice replaces the previous adapter - matching the documented
 * "last registration wins" contract.
 *
 * @stable
 */
declare function setVaultAdapter(adapter: VaultAdapter | undefined): void;
/**
 * Built-in `vault://` resolver. Acts as a router for an optional
 * adapter - when no adapter is registered, it raises a typed
 * resolution error pointing at the documented escape hatch.
 *
 * @stable
 */
declare const vaultResolver: SecretResolver;
//#endregion
export { VaultAdapter, setVaultAdapter, vaultResolver };
//# sourceMappingURL=vault.d.ts.map