/**
 * caldav-gateway-config.ts, where the daemon's CalDAV connection comes from,
 * and how a logical calendar id becomes a collection URL.
 *
 * Config keys (all daemon-owned, all real `CONFIG_SCHEMA` entries, all
 * rendered in the settings modal):
 *
 *   surfaces.calendar.caldavUrl          the collection or server URL
 *   surfaces.calendar.caldavUser         account name
 *   surfaces.calendar.caldavPassword     a secret REFERENCE, never a password
 *   surfaces.calendar.defaultCalendarId  used when a request names no calendar
 *   surfaces.calendar.calendars          logical id -> collection path, as JSON
 *
 * The operator-facing errors name those keys verbatim, because an error that
 * says what to set is the difference between a two-minute fix and a support
 * thread.
 *
 * Two properties this module keeps:
 *
 *  - **The password never comes from config.** `caldavPassword` holds either a
 *    `goodvibes://secrets/...` reference or a bare secret-store key; either way
 *    the value is fetched from the secret store. A raw password pasted into
 *    config resolves to nothing rather than being used, which is deliberate: a
 *    credential in a settings file is a credential in every backup of it.
 *  - **The authenticated URL never leaves.** `calendarId` is a LOGICAL id.
 *    Everything here maps it inward to a URL; `toRelativeHref` maps server
 *    answers back outward to host-relative paths, so no response carries the
 *    scheme+host a credential is scoped to.
 */
export declare const CALDAV_URL_KEY = "surfaces.calendar.caldavUrl";
export declare const CALDAV_USER_KEY = "surfaces.calendar.caldavUser";
export declare const CALDAV_PASSWORD_KEY = "surfaces.calendar.caldavPassword";
export declare const CALDAV_DEFAULT_CALENDAR_KEY = "surfaces.calendar.defaultCalendarId";
export declare const CALDAV_CALENDARS_KEY = "surfaces.calendar.calendars";
/** Reads settings. Narrow on purpose: a string key in, an unknown value out. */
export interface CalDavConfigPort {
    get(key: string): unknown;
}
/** Resolves credentials. Mirrors the daemon credential store's two questions. */
export interface CalDavSecretPort {
    /** A `goodvibes://secrets/...` reference, or a bare secret-store key. */
    resolveRef(ref: string): Promise<string | null>;
    /** The secret a config key implies (`daemonSecretKeyFor`). */
    resolveConfigSecret(configKey: string): Promise<string | null>;
}
export interface CalDavGatewayConfig {
    readonly baseUrl: string;
    readonly username: string;
    readonly password: string;
    readonly defaultCalendarId: string;
    /** Logical calendarId -> collection path (host-absolute, or relative to the base URL). */
    readonly collectionMap: Readonly<Record<string, string>>;
}
/**
 * A secret port over a plain `secretsManager.get`, using the platform-wide
 * name derivation. Built here rather than in the composition root so the
 * derivation cannot drift from the one `setup-plan.ts` writes with.
 */
export declare function createCalDavSecretPort(secretsManager: {
    get(key: string): Promise<string | null>;
}): CalDavSecretPort;
/**
 * `surfaces.calendar.calendars` as a logical id -> collection path map.
 *
 * Malformed JSON, a JSON array, or a non-string entry is ignored rather than
 * refused: the fallback is default-calendar-only behaviour, which still works,
 * where a thrown error would take the whole calendar surface down over a typo
 * in an optional setting.
 */
export declare function parseCollectionMap(raw: string | undefined): Record<string, string>;
/**
 * Resolve the whole CalDAV connection: settings from the config port, password
 * from the secret port. Throws `GatewayVerbError` naming the exact key to set
 * when the surface is not configured. The password is held in memory for the
 * life of the returned object and never returned to a caller.
 */
export declare function resolveCalDavGatewayConfig(config: CalDavConfigPort, secrets: CalDavSecretPort): Promise<CalDavGatewayConfig>;
export declare function stripTrailingSlash(value: string): string;
export declare function joinUrl(base: string, segment: string): string;
/** The scheme+host origin of an absolute URL, without a trailing slash. */
export declare function originOf(url: string): string;
/**
 * Resolve a configured collection path. A host-absolute path (starting with
 * '/') resolves against the origin of the base URL; anything else is a child
 * segment of the base URL.
 */
export declare function resolveCollectionUrl(baseUrl: string, path: string): string;
/**
 * An absolute or host-relative href from the server, as an opaque host-relative
 * identifier. Strips scheme + host so an authenticated URL never reaches a
 * caller.
 */
export declare function toRelativeHref(href: string): string;
/**
 * Does an event identifier look like a resource href rather than a bare
 * iCalendar UID? Hrefs contain a path separator or end in `.ics`; UIDs are
 * opaque tokens (often `uuid@host`) with no path component.
 */
export declare function isHrefLike(eventId: string): boolean;
/**
 * An href-like identifier as an absolute, authenticated resource URL for a
 * direct GET. A host-absolute href resolves against the base URL's origin;
 * anything else is a resource name inside the target collection.
 */
export declare function resolveResourceUrl(collectionUrl: string, baseUrl: string, eventId: string): string;
/** The host-relative collection path implied by an absolute collection URL. */
export declare function collectionPathOrRoot(collectionUrl: string, baseUrl: string): string;
/** The collection path a logical calendar id maps to (empty = the base URL itself). */
export declare function collectionPathFor(config: CalDavGatewayConfig, calendarId: string | undefined): string;
/** The absolute collection URL a logical calendar id maps to. */
export declare function collectionUrlFor(config: CalDavGatewayConfig, calendarId: string | undefined): string;
//# sourceMappingURL=caldav-gateway-config.d.ts.map