import type { SecretRefResolutionOptions } from './secret-refs.js';
/**
 * secret-ref-refusal.ts, telling a malformed reference from a literal secret.
 *
 * `resolveSecretInput` asked `normalizeSecretRef` whether a value was a valid
 * reference and, on `null`, concluded it must be a literal secret. That is a
 * rule that succeeds by convention: it is right for every string that was never
 * meant to be a reference, and catastrophically wrong for the one case it
 * cannot distinguish, a reference with a typo in it.
 *
 * The consequence was not subtle. A mistyped `goodvibes://secrets/...` in a
 * config file became the credential: the reference TEXT was handed to a
 * transport as an auth token, sent to a third party, and written into their
 * logs. The response was a 401, which sends whoever debugs it looking for a
 * wrong token rather than a malformed reference.
 *
 * So the question is split in two. "Does this parse as a reference" is
 * `normalizeSecretRef`. "Was this MEANT to be a reference" is
 * `looksLikeSecretRef`, and a value that was meant to be one and is not a valid
 * one is refused rather than used.
 */
/**
 * The URI schemes this module treats as a secret REFERENCE.
 *
 * Read straight off the parser's own accept list, so a scheme added there is
 * recognised here without anyone remembering.
 */
export declare const GOODVIBES_URI_PREFIX = "goodvibes://";
/**
 * True when this text is SHAPED like a secret reference, whether or not it
 * parses as one.
 *
 * The distinction is the whole point. `normalizeSecretRef` answers "is this a
 * valid reference", and `resolveSecretInput` used to read a `null` from it as
 * "then it must be a literal secret", a rule that succeeds by convention. A
 * typo in a config reference therefore became the credential: the reference
 * TEXT was handed to a transport as an auth token, sent to a third party, and
 * logged there. What came back was a 401, which sends whoever debugs it hunting
 * for a wrong token rather than a malformed reference.
 */
export declare function looksLikeSecretRef(input: unknown): boolean;
/**
 * Describe a malformed reference by SHAPE alone, for a diagnostic.
 *
 * Never returns the value. A malformed reference is usually not a credential,
 * but "usually" is not a property to log on, and the text may contain whatever
 * the operator meant to paste. Scheme and structure are enough to fix a typo.
 */
export declare function describeMalformedSecretRef(input: string): string;
/** Raised when a value shaped like a reference cannot be parsed as one. */
export declare class MalformedSecretRefError extends Error {
    readonly shape: string;
    readonly configKey: string | undefined;
    constructor(shape: string, configKey?: string);
}
/**
 * Decide what to do with a value that is reference-shaped and did not parse.
 *
 * Returns true only when the caller has explicitly asserted the value is a
 * literal secret that merely looks like a reference. Either way the outcome is
 * disclosed: a refusal names the setting and the shape so an operator is told
 * WHICH reference is malformed, instead of being handed an authentication error
 * to chase. Neither branch ever logs the value.
 */
export declare function acceptRefShapedLiteral(value: string, options: {
    readonly configKey?: string | undefined;
    readonly treatUnparseableRefAsLiteral?: boolean | undefined;
}): boolean;
export declare function resolveSecretInput(input: unknown, options?: SecretRefResolutionOptions): Promise<string | null>;
//# sourceMappingURL=secret-ref-refusal.d.ts.map