/**
 * ServiceRegistry, named service credential resolution.
 *
 * Reads service configs from the configured services.json path.
 * Each service entry declares its authType and the SecretsManager key
 * that holds the credential.
 *
 * Example services.json:
 * {
 *   "openai": { "name": "openai", "baseUrl": "https://api.openai.com", "authType": "bearer", "tokenKey": "OPENAI_API_KEY" },
 *   "github":  { "name": "github",  "baseUrl": "https://api.github.com",  "authType": "bearer", "tokenKey": "GITHUB_TOKEN" },
 *   "slack":   { "name": "slack", "authType": "bearer", "tokenKey": "SLACK_BOT_TOKEN", "appTokenKey": "SLACK_APP_TOKEN", "tokenRef": { "source": "vaultwarden", "item": "GoodVibes Slack", "field": "password", "server": "https://vault.example.test" } }
 * }
 */
import { SecretsManager } from './secrets.js';
import { type SecretRefInput } from './secret-refs.js';
import type { OAuthProviderConfig } from './subscriptions.js';
import { SubscriptionManager } from './subscriptions.js';
export interface ServiceConfig {
    /** Human-readable / lookup name. */
    name: string;
    /** Base URL for the service (informational). */
    baseUrl?: string | undefined;
    /** Auth type used by this service. */
    authType: 'bearer' | 'basic' | 'api-key' | 'oauth';
    /** SecretsManager key that holds the primary credential (token or API key). */
    tokenKey: string;
    /** Optional external/local secret reference for the primary credential. */
    tokenRef?: SecretRefInput | undefined;
    /** For basic auth: SecretsManager key that holds the password. */
    passwordKey?: string | undefined;
    /** Optional external/local secret reference for the basic-auth password. */
    passwordRef?: SecretRefInput | undefined;
    /** Optional provider auth-token key for services that expose token + auth-token credentials. */
    authTokenKey?: string | undefined;
    /** Optional external/local secret reference for provider auth-token credentials. */
    authTokenRef?: SecretRefInput | undefined;
    /** For api-key auth: the header name. Defaults to X-API-Key. */
    apiKeyHeader?: string | undefined;
    /** Optional secret key holding a webhook or callback URL for this service. */
    webhookUrlKey?: string | undefined;
    /** Optional external/local secret reference for a webhook or callback URL. */
    webhookUrlRef?: SecretRefInput | undefined;
    /** Optional secret key for inbound request signing/verification. */
    signingSecretKey?: string | undefined;
    /** Optional external/local secret reference for inbound request signing/verification. */
    signingSecretRef?: SecretRefInput | undefined;
    /** Optional public-key secret used for inbound signature verification. */
    publicKeyKey?: string | undefined;
    /** Optional external/local secret reference for inbound public-key verification. */
    publicKeyRef?: SecretRefInput | undefined;
    /** Optional Slack-style app-level token key used by socket/client runtimes. */
    appTokenKey?: string | undefined;
    /** Optional external/local secret reference for app-level socket/client runtimes. */
    appTokenRef?: SecretRefInput | undefined;
    /** Optional provider ID used for subscription token override lookup. */
    providerId?: string | undefined;
    /** OAuth metadata for subscription-backed services. */
    oauth?: OAuthProviderConfig | undefined;
}
export type ServiceSecretField = 'primary' | 'password' | 'authToken' | 'webhookUrl' | 'signingSecret' | 'publicKey' | 'appToken';
export interface ServiceInspection {
    readonly config: ServiceConfig;
    readonly hasPrimaryCredential: boolean;
    readonly hasPasswordCredential: boolean;
    readonly hasAuthTokenCredential: boolean;
    readonly hasWebhookUrl: boolean;
    readonly hasSigningSecret: boolean;
    readonly hasPublicKey: boolean;
    readonly hasAppToken: boolean;
}
export interface ServiceConnectionTestResult {
    readonly ok: boolean;
    readonly status: number | null;
    readonly testedUrl: string | null;
    readonly error?: string | undefined;
}
export interface ServiceRegistryOptions {
    readonly secretsManager: SecretsManager;
    readonly subscriptionManager: SubscriptionManager;
}
export declare class ServiceRegistry {
    private readonly servicesFilePath;
    private readonly secretsManager;
    private readonly subscriptionManager;
    constructor(servicesFilePath: string, options: ServiceRegistryOptions);
    /**
     * Return all registered service configs.
     */
    getAll(): Record<string, ServiceConfig>;
    /**
     * Return the config for a named service, or null if not found.
     */
    get(serviceName: string): ServiceConfig | null;
    private resolveConfiguredSecret;
    /**
     * Resolve auth headers for a named service.
     * Looks up the service config, fetches credential from SecretsManager,
     * and returns the appropriate HTTP headers.
     *
     * Returns null if the service is not registered or credential is unavailable.
     */
    resolveAuth(serviceName: string): Promise<Record<string, string> | null>;
    resolveSecret(serviceName: string, field: ServiceSecretField): Promise<string | null>;
    inspect(serviceName: string): Promise<ServiceInspection | null>;
    testConnection(serviceName: string): Promise<ServiceConnectionTestResult>;
}
//# sourceMappingURL=service-registry.d.ts.map