/** SDK-owned platform module. This implementation is maintained in goodvibes-sdk. */
export type SecretProviderSource = 'env' | 'goodvibes' | 'file' | 'exec' | '1password' | 'onepassword' | 'bitwarden' | 'vaultwarden' | 'bitwarden-secrets-manager' | 'bws';
export type BitwardenSecretField = 'password' | 'username' | 'notes' | 'totp' | 'item' | `login.${string}` | string;
export interface EnvSecretRef {
    readonly source: 'env';
    readonly id: string;
}
export interface GoodVibesSecretRef {
    readonly source: 'goodvibes';
    readonly id: string;
}
export interface FileSecretRef {
    readonly source: 'file';
    readonly path: string;
    readonly selector?: string | undefined;
}
export interface ExecSecretRef {
    readonly source: 'exec';
    readonly command: string;
    readonly args?: readonly string[] | undefined;
    readonly env?: Record<string, string> | undefined;
    readonly stdin?: string | undefined;
    readonly timeoutMs?: number | undefined;
}
export interface OnePasswordSecretRef {
    readonly source: '1password' | 'onepassword';
    readonly ref?: string | undefined;
    readonly vault?: string | undefined;
    readonly item?: string | undefined;
    readonly field?: string | undefined;
    readonly account?: string | undefined;
    readonly cli?: string | undefined;
    readonly timeoutMs?: number | undefined;
}
export interface BitwardenSecretRef {
    readonly source: 'bitwarden' | 'vaultwarden';
    readonly item: string;
    readonly field?: BitwardenSecretField | undefined;
    readonly customField?: string | undefined;
    readonly cli?: string | undefined;
    readonly appDataDir?: string | undefined;
    readonly sessionEnv?: string | undefined;
    readonly server?: string | undefined;
    readonly serverEnv?: string | undefined;
    readonly validateServer?: boolean | undefined;
    readonly syncBeforeRead?: boolean | undefined;
    readonly timeoutMs?: number | undefined;
}
export interface BitwardenSecretsManagerRef {
    readonly source: 'bitwarden-secrets-manager' | 'bws';
    readonly id: string;
    readonly field?: string | undefined;
    readonly cli?: string | undefined;
    readonly accessTokenEnv?: string | undefined;
    readonly accessToken?: string | undefined;
    readonly profile?: string | undefined;
    readonly configFile?: string | undefined;
    readonly serverUrl?: string | undefined;
    readonly timeoutMs?: number | undefined;
}
export type SecretRef = EnvSecretRef | GoodVibesSecretRef | FileSecretRef | ExecSecretRef | OnePasswordSecretRef | BitwardenSecretRef | BitwardenSecretsManagerRef;
export type SecretRefInput = string | SecretRef;
export interface SecretCommandRunOptions {
    readonly env?: Record<string, string> | undefined;
    readonly stdin?: string | undefined;
    readonly timeoutMs?: number | undefined;
}
export interface SecretCommandRunResult {
    readonly exitCode: number;
    readonly stdout: string;
    readonly stderr: string;
}
export type SecretCommandRunner = (command: string, args: readonly string[], options?: SecretCommandRunOptions) => Promise<SecretCommandRunResult>;
export interface SecretRefResolutionOptions {
    readonly resolveLocalSecret?: ((key: string) => Promise<string | null>) | undefined;
    readonly runCommand?: SecretCommandRunner | undefined;
    readonly homeDirectory?: string | undefined;
    /** Names the setting in a refusal, so an operator is not handed a 401 to chase. */
    readonly configKey?: string | undefined;
    /** Assert a reference-SHAPED value is a literal. Off by default; secret-ref-refusal.ts. */
    readonly treatUnparseableRefAsLiteral?: boolean | undefined;
}
export interface SecretRefResolution {
    readonly source: SecretProviderSource;
    readonly value: string | null;
}
export declare const BUILTIN_SECRET_PROVIDER_SOURCES: readonly SecretProviderSource[];
export declare function normalizeSecretRef(input: unknown): SecretRef | null;
export declare function isSecretRefInput(input: unknown): input is SecretRefInput;
export declare function getSecretRefSource(input: unknown): SecretProviderSource | null;
export declare function describeSecretRef(input: unknown): string;
export declare function resolveSecretRef(input: SecretRefInput, options?: SecretRefResolutionOptions): Promise<SecretRefResolution>;
export { resolveSecretInput } from './secret-ref-refusal.js';
//# sourceMappingURL=secret-refs.d.ts.map