/**
 * Load connector declarations from skaile.yaml.
 *
 * The top-level `mounts:` key is no longer accepted (hard cut as of Task 11).
 * Filesystem-projected backends must be declared under `connectors:` with a
 * `mount:` sub-block. See `docs/migration-mounts-to-connectors.md`.
 */
import type { ResolvedSkaileConfig } from "@skaile/workspaces/types";
import type { ConnectorDeclaration } from "./connector-types.js";
/**
 * Read `skaile.yaml` in `projectDir` and return all declared connectors as `ConnectorDeclaration[]`.
 *
 * Throws a migration error when the legacy top-level `mounts:` key is present.
 *
 * @param projectDir - Root of the workspace (directory containing `skaile.yaml`).
 * @returns Merged array of connector declarations from `skaile.yaml` and the materialized
 *   `.skaile/assets/connector/*` disk projection (Phase 2.5); empty array if neither source
 *   contributes any entries. `skaile.yaml` wins on id collision.
 * @docLink packages/connectors/api-reference#load-connector-declarations
 */
export declare function loadConnectorDeclarations(projectDir: string): ConnectorDeclaration[];
/**
 * Map a Protocol v3 `session_init` `resolvedConfig` to `ConnectorDeclaration[]`.
 *
 * Wire mounts are flat (`source` / `target` / `watch` top-level per
 * `ResolvedSkaileConfig`); declarations carry them in the `mount:` sub-block.
 * Wire `connectors` (tool-face) map without a mount block. Malformed entries
 * (missing `id`, `driver`, or — for mounts — `source`) are logged and dropped,
 * never thrown: one bad wire entry must not kill session boot. Duplicate ids
 * (within or across the two arrays) keep the FIRST occurrence — mounts precede
 * connectors — and the shadowed entry is logged and dropped the same way.
 *
 * Pure function, no I/O. Used by the runner as the disk-first fallback when
 * `skaile.yaml` declares no connectors (e.g. broker mode, where only the
 * workspace subdirectory is bound and no yaml file exists).
 *
 * @param resolved - `mounts` / `connectors` arrays from the platform-resolved config.
 * @returns Declarations in wire order — mounts first, then connectors.
 * @docLink packages/connectors/api-reference#resolved-config-to-declarations
 */
export declare function resolvedConfigToDeclarations(resolved: Pick<ResolvedSkaileConfig, "mounts" | "connectors">): ConnectorDeclaration[];
import type { ForgeSecretProvider, SecretProvider } from "./secrets.js";
import { SecretProviderChain } from "./secrets.js";
/**
 * Build a `SecretProviderChain` for Forge session context.
 * `OAuthSecretProvider` is not wired here — it must be provided externally
 * (the Forge session manager constructs it and passes it in).
 * @param forgeProvider - The Forge-provisioned secret store.
 * @param extraProviders - Additional providers prepended to the chain (e.g. an OAuth provider).
 * @returns A chain that routes `forge:` refs to the Forge store and `env:` refs to process.env.
 * @docLink packages/connectors/api-reference#create-forge-secret-provider-chain
 */
export declare function createForgeSecretProviderChain(forgeProvider: ForgeSecretProvider, extraProviders?: SecretProvider[]): SecretProviderChain;
/**
 * Build a `SecretProviderChain` for CLI/standalone context.
 * `EnvSecretProvider` takes priority; `extraSecrets` are loaded into an `InMemorySecretProvider`.
 * @param extraSecrets - Inline secrets injected into memory (e.g. tokens passed via CLI flags).
 * @returns A chain that resolves `env:` refs from process.env plus any inline extras.
 * @docLink packages/connectors/api-reference#create-cli-secret-provider-chain
 */
export declare function createCliSecretProviderChain(extraSecrets?: Record<string, string>): SecretProviderChain;
/**
 * Provider kind for a mount auth ref.
 *
 * Two values are accepted:
 *   - `pat`     — static personal access token resolved via the secrets chain
 *                 (standalone CLI / non-platform contexts).
 *   - `backend` — token minted by the platform's credential mediator over the
 *                 transport (`request_access_token` round-trip). Provider
 *                 dispatch (OAuth, GitHub App, ...) lives backend-side; the
 *                 runner stays provider-agnostic.
 *
 * @docLink packages/connectors/api-reference#mount-auth-kind
 */
export type MountAuthKind = "pat" | "backend";
/**
 * Parsed mount `auth:` field.
 *
 *   - `pat`     → `value` is the inner secret ref (e.g. `env:NAME`).
 *   - `backend` → `value` is empty (sentinel only); the runner asks the
 *                 backend for tokens via `request_access_token`.
 *
 * @docLink packages/connectors/api-reference#mount-auth-ref
 */
export interface MountAuthRef {
    kind: MountAuthKind;
    /** Prefix-stripped payload — see kind for shape. Empty for `backend`. */
    value: string;
    /** Original auth string from the declaration, kept for diagnostics. */
    raw: string;
}
/**
 * Thrown when a mount declaration's `auth:` field uses the legacy bare `env:NAME` grammar
 * or any other unrecognized form. Migrate to `pat:env:NAME` (standalone) or `backend`
 * (platform-mediated).
 * @docLink packages/connectors/api-reference#legacy-auth-grammar-error
 */
export declare class LegacyAuthGrammarError extends Error {
    readonly auth: string;
    constructor(auth: string, mountId?: string);
}
/**
 * Resolve the `auth: backend` initial mint for a given mount or connector id
 * by querying the secrets chain with a `${kind}:${id}` ref. Returns the
 * resolved bearer token or `undefined` if no pre-minted credential is
 * available.
 *
 * Used by the runner when wiring `ConnectorManager` to
 * answer initial-mint requests from `PreMintedSecretProvider` without
 * round-tripping to the platform. Drivers continue to receive a
 * `tokenMediator` for refresh + retry-401 paths.
 *
 * @param kind Resource family (`mount` or `connector`).
 * @param id Resource declaration id.
 * @param chain Secrets chain. Pass `undefined` to return `undefined`.
 * @returns The pre-minted token, or `undefined` if not stored on the chain.
 * @docLink packages/connectors/api-reference#resolve-backend-auth-for
 */
export declare function resolveBackendAuthFor(kind: "mount" | "connector", id: string, chain: import("./secrets.js").SecretProvider | undefined): string | undefined;
/**
 * Parse a mount-side auth ref into a typed `MountAuthRef`.
 *
 * Accepted forms:
 *   - `backend`      — platform-mediated mint via `request_access_token`.
 *   - `pat:env:NAME` — static PAT resolved from the secrets chain.
 *
 * Rejects bare `env:NAME` (legacy) and provider-prefixed grammars (`oauth:`,
 * `github-app:`) — those moved backend-side as part of Tier-2 mediation.
 * Returns `undefined` when `auth` is absent or empty.
 *
 * @param auth - Raw `auth:` value from the mount declaration.
 * @param mountId - Optional mount id included in error messages.
 * @returns Parsed `MountAuthRef` or `undefined`.
 * @throws {LegacyAuthGrammarError} for any unrecognized grammar.
 * @docLink packages/connectors/api-reference#resolve-auth-ref
 */
export declare function resolveAuthRef(auth: string | undefined, mountId?: string): MountAuthRef | undefined;
//# sourceMappingURL=config.d.ts.map