import type { Client, Item } from '@1password/sdk';
import type { ResolvedSecret } from '@struktoai/mirage-core/secrets/types';
import type { OnePasswordConfig } from './config.ts';
export declare const OP_SCHEME = "op://";
export declare const TOKEN_VAR = "OP_SERVICE_ACCOUNT_TOKEN";
export declare const INTEGRATION_NAME = "mirage";
export declare const NOTES_KEY = "notesPlain";
/** A 1Password reference split into its parts. */
export interface OpRef {
    readonly vault: string;
    readonly item: string;
    /** The field label; empty for an item reference. */
    readonly field: string;
}
/**
 * Split a 1Password secret reference into vault, item and field.
 *
 * Both of 1Password's own ref shapes are accepted, and they mean
 * different fetches: an item reference reads every field, so N
 * variables out of one item cost one call, while a field reference
 * (`op://<vault>/<item>[/<section>]/<field>`) is resolved as itself,
 * which is what the app's "Copy Secret Reference" button hands you.
 *
 * Throws SecretsError on an empty ref, one that is not an `op://` url,
 * or one naming less than a vault and an item.
 */
export declare function parseOpRef(ref: string): OpRef;
/**
 * Authenticate a 1Password SDK client.
 *
 * The SDK loads on first use (the lazy-module trick Python spells as
 * an import path). Built per fetch rather than cached, because a
 * fetched value lands on a session var and never refetches, so a cache
 * would keep an authenticated handle alive long past the line that
 * needed one. An absent `token` falls back to the process env, so a
 * deployment with one account declares nothing.
 *
 * Throws SecretsError when neither the config nor the env carries a
 * service account token.
 */
export declare function onePasswordClient(config: OnePasswordConfig): Promise<Client>;
/**
 * Resolve a vault's id from the name a ref spells.
 *
 * A ref names a vault by title, which the item API cannot take, so
 * this is the extra call an item reference costs. An id matches too,
 * so a deployment that pins ids never pays for the title lookup being
 * wrong after a rename. Throws SecretsError when no vault matches.
 */
export declare function findVaultId(client: Client, name: string): Promise<string>;
/**
 * Resolve an item's id within one vault, by title or by id.
 *
 * Throws SecretsError when no item of that title or id is in the
 * vault.
 */
export declare function findItemId(client: Client, vaultId: string, name: string): Promise<string>;
/**
 * Shape one item into secret fields, keyed by field label.
 *
 * Labels are what a ref and a managed entry's `key` both address, and
 * 1Password fixes the built-in ones per category (an API Credential
 * item's secret is `credential`), so they are the keys here. Two
 * fields sharing a label in different sections is the one ambiguity,
 * and the later one wins -- the SDK refuses such a ref outright, so
 * neither shape promises more than the other.
 */
export declare function fieldsFromItem(item: Item): Record<string, string>;
/**
 * Fetch one secret from 1Password.
 *
 * A field reference is one `resolve` call and returns that field
 * alone, keyed by its label; an item reference is a vault lookup, an
 * item lookup and a get, and returns every field, which is what lets
 * one AWS item fill four variables on one await. 1Password does not
 * expire an item, so `expiresAt` stays absent.
 */
export declare function fetchOnePassword(config: OnePasswordConfig, ref: string): Promise<ResolvedSecret>;
//# sourceMappingURL=onepassword.d.ts.map