export type OmpAuthStorageMode = 'environment' | 'broker' | 'none' | 'omp-home';
interface ClosableAuthStorage {
    close(): void;
}
interface BrokerCredentials {
    readonly token?: string | undefined;
    readonly url?: string | undefined;
}
interface OmpAuthStoragePolicyOptions<T extends ClosableAuthStorage> {
    readonly mode: OmpAuthStorageMode;
    readonly sourceDirectory?: unknown;
    readonly privateAgentDirectory: string;
    readonly privateDatabasePath: string;
    readonly brokerCachePath: string;
    readonly brokerCredentials?: BrokerCredentials;
    readonly sourceLabel: string;
    readonly createDatabase: (databasePath: string) => Promise<T>;
    readonly discoverBroker: (agentDirectory: string, options: {
        cachePath: string;
        sourceLabel: string;
    }) => Promise<T>;
}
/**
 * Snapshot only OMP's credential database. Configuration, broker token, and
 * other files in the source home are deliberately outside this policy.
 */
export declare function snapshotOmpAuthDatabase(sourceDirectory: unknown, privateDatabasePath: string): void;
/** Open auth through one fail-closed policy shared by diagnostics and execution. */
export declare function openOmpAuthStorage<T extends ClosableAuthStorage>(options: OmpAuthStoragePolicyOptions<T>): Promise<T>;
export {};
//# sourceMappingURL=auth-policy.d.ts.map