import { z } from 'zod';
export declare const BOOTSTRAP_SOURCES: readonly string[];
/**
 * One entry of the env map: a literal value or a managed pointer.
 *
 * The env block is one map, name -> entry. A bare string in the map is
 * the literal short form and never reaches this schema; a mapping is
 * validated through it. `value` and `from` are mutually exclusive and
 * one is required: `export` belongs to a literal entry, `ref`/`key`/
 * `fetch` to a managed one, and `readonly` to either -- a managed
 * credential the agent cannot overwrite is filled all the same,
 * because the fetch writes the record itself rather than going through
 * the shell's assignment gate. The wire key is `from:` in both
 * languages; Python exposes it as `provider` in code only because
 * `from` is a keyword there.
 */
export declare const EnvVarSchema: z.ZodObject<{
    value: z.ZodOptional<z.ZodString>;
    readonly: z.ZodDefault<z.ZodBoolean>;
    export: z.ZodDefault<z.ZodBoolean>;
    from: z.ZodOptional<z.ZodString>;
    ref: z.ZodDefault<z.ZodString>;
    key: z.ZodOptional<z.ZodString>;
    fetch: z.ZodDefault<z.ZodEnum<{
        lazy: "lazy";
        eager: "eager";
    }>>;
}, z.core.$strict>;
export type EnvVar = z.infer<typeof EnvVarSchema>;
/** The env block as an embedder or the config door writes it. */
export type EnvEntries = Record<string, string | z.input<typeof EnvVarSchema>>;
/**
 * A source-config value read from a bootstrap source.
 *
 * The config plane's pointer, spelled with the same three keys the env
 * plane's managed entry uses, so one grammar covers both. Only a
 * bootstrap source may back one: those take no config of their own,
 * which is what stops the table from needing a dependency graph.
 */
export declare const SecretRefSchema: z.ZodObject<{
    from: z.ZodString;
    ref: z.ZodDefault<z.ZodString>;
    key: z.ZodString;
}, z.core.$strict>;
export type SecretRef = z.infer<typeof SecretRefSchema>;
/**
 * One declared source instance: which source, and its config.
 *
 * The `secrets:` block is one map, name -> source, spelled the way
 * `mounts:` and `clis:` are: a type beside a config. The instance
 * name is what a managed env entry's `from:` names, so two accounts of
 * one platform are two instances, and an instance named after its
 * source reads as that source configured.
 *
 * The config map is untyped here, the way `mounts.*.config` is: each
 * source owns its own model, and this model only has to tell a pointer
 * from a literal. It does that the way the env plane does, by the
 * presence of `from`, so a mapping carrying one is validated as a
 * `SecretRef` and every other value passes through to the source's
 * model.
 */
export declare const SecretSourceSchema: z.ZodObject<{
    source: z.ZodString;
    config: z.ZodPipe<z.ZodDefault<z.ZodCustom<Record<string, unknown>, Record<string, unknown>>>, z.ZodTransform<{
        [k: string]: unknown;
    }, Record<string, unknown>>>;
}, z.core.$strict>;
export type SecretSource = z.infer<typeof SecretSourceSchema>;
/** The `secrets:` block as an embedder or the config door writes it. */
export type SecretEntries = Record<string, z.input<typeof SecretSourceSchema>>;
//# sourceMappingURL=config.d.ts.map