import type { z } from 'zod';
import type { ResolvedSecret, ResolvedSource, SecretFetchFn } from './types.ts';
/** One resolvable source: its config model and its fetch function. */
export interface SourceEntry {
    readonly configModel: z.ZodType;
    readonly fetch: SecretFetchFn;
    /**
     * Throws when the source's optional dependency is absent, and is
     * called by `sourceFor` -- so a declaration naming a source whose
     * SDK is not installed fails where the workspace is built, with the
     * package to install, rather than as a redacted fetch failure on the
     * first line that reads a secret. Python gets this for free: its
     * `sourceFor` resolves an import path, so the ModuleNotFoundError is
     * the check. A dynamic import here is async and construction is
     * not, hence a synchronous probe the source supplies.
     */
    readonly requirePeer?: () => void;
}
/**
 * Register a secrets source under a name.
 *
 * Host-side only, like `registerCli`: the embedding program calls it,
 * never a line the agent types. A source is one config model plus one
 * async function; there is no Provider class. Registering an existing
 * name replaces it, builtins included -- the host owns both sides of
 * this registry, so shadowing `env` is a deployment decision, not an
 * escalation.
 */
export declare function registerSecrets<C>(name: string, configModel: z.ZodType<C>, fetch: SecretFetchFn<C>, requirePeer?: () => void): void;
/** Every name `sourceFor` can resolve. */
export declare function knownSources(): string[];
/**
 * Resolve a source name to its config model and fetch function.
 *
 * Throws SecretsError when `name` is not registered. The node package
 * registers the builtin sources (`env`, `dotenv`, `aws-sm`) on import;
 * a browser workspace resolves only what its embedder registered.
 */
export declare function sourceFor(name: string): SourceEntry;
/**
 * Fetch one secret from a named source.
 *
 * The whole call path: resolve the source, take its config, run its
 * fetch. Pure and module-level -- there is no resolver class, and no
 * cache: fetched values live only on session vars.
 *
 * `source` names a declared instance first and a source second, so a
 * deployment with one account of a platform can leave the `secrets:`
 * block out entirely and still spell `from: aws-sm`. An undeclared
 * name builds its config from ambient defaults, which is what every
 * source did before the block existed.
 */
export declare function fetchSecret(source: string, ref: string, sources?: Readonly<Record<string, ResolvedSource>>): Promise<ResolvedSecret>;
//# sourceMappingURL=registry.d.ts.map