import type { SerializedTool } from '@openai/agents-core';
/**
 * The hosted tool a credential is being requested for, identified by the
 * non-secret configuration the Workflow declared. A shell or code interpreter
 * tool carries its own `name`; every tool `hostedMcpTool()` builds is named
 * `hosted_mcp`, so `serverLabel` with `serverUrl` or `connectorId` is what
 * separates two of those — two sharing both are indistinguishable here.
 */
export type HostedToolIdentity = {
    tool: 'hostedMcp';
    name: string;
    serverLabel: string;
    serverUrl?: string;
    connectorId?: string;
} | {
    tool: 'shell';
    name: string;
    allowedDomains: string[];
} | {
    tool: 'codeInterpreter';
    name: string;
    allowedDomains: string[];
};
/** Domain-scoped secret for one allowlisted domain of a shell or code interpreter tool. */
export interface HostedToolDomainSecret {
    domain: string;
    name: string;
    value: string;
}
/**
 * Credentials for one hosted tool. `authorization` and `headers` apply to a
 * hosted MCP tool; `domainSecrets` to a shell or code interpreter tool. A value
 * that is not a string — `undefined`, `null`, a value of some other type —
 * supplies no credential and fails nothing: that one field reaches the model
 * provider as the Workflow declared it while the rest are still filled in, so a
 * credential that never arrives surfaces as an authentication failure from the
 * tool provider rather than as a Temporal error.
 */
export interface HostedToolCredentials {
    authorization?: string;
    headers?: Record<string, string>;
    domainSecrets?: HostedToolDomainSecret[];
}
/**
 * Resolves the credentials for one hosted tool, Worker-side.
 *
 * Called for every hosted tool that has somewhere to put a credential, on each
 * model invocation, so a deployment that reads from a secret manager should
 * cache. A hosted MCP tool needs a server label to be asked about; a shell tool
 * needs a `container_auto` environment with a domain allowlist; a code
 * interpreter needs an inline container definition with a domain allowlist —
 * naming an existing container by id skips the callback even though that
 * container may carry an allowlist of its own. Only the fields the Workflow left
 * out are filled in; return nothing to leave a tool as the Workflow declared it.
 *
 * A throw fails the model Activity, keeping whatever retryability it carries.
 * The error's own message reaches Workflow history, so keep credentials out of it.
 */
export type HostedToolCredentialsResolver = (identity: HostedToolIdentity) => HostedToolCredentials | undefined | Promise<HostedToolCredentials | undefined>;
/**
 * Clones each tool it fills in rather than writing into the Activity input.
 *
 * Nothing strips the credentials back out of the model response: what a model
 * provider echoes back is that provider's to redact, not this plugin's.
 */
export declare function injectHostedToolCredentials(tools: SerializedTool[], resolve: HostedToolCredentialsResolver): Promise<SerializedTool[]>;