/**
 * Token resolution — ordered, first-non-empty-wins.
 *
 * Iterates a provider's `token` source list and returns the first source that
 * yields a non-empty value. Two source shapes:
 *   - `{ env: "NAME" }`                — read from process env (no trimming)
 *   - `{ command: argv }`              — run a command, return trimmed stdout
 *   - `{ command: "gh auth token" }`   — convenience: whitespace-tokenized into
 *     argv. **Not** passed through a shell — operators (`|`, `&&`, `$(...)`)
 *     become literal argv elements, per the design's §6.1 sharp-edge note.
 *
 * Command sources can be disabled at runtime with `VAT_LINKAUTH_ALLOW_COMMAND=0`
 * (or by passing `allowCommand: false` in deps). Useful in security-sensitive
 * environments where arbitrary command execution is undesirable.
 *
 * Returns `undefined` if every source fails or yields an empty/whitespace
 * value — the caller's `resolveAuthenticatedUrl` translates that to the
 * `unverified` outcome (surfaced as `LINK_AUTH_UNVERIFIED` by the validator).
 *
 * Per design issue #113 §4 (token vocabulary) and §6.1 (command execution,
 * `safeExecSync`-backed, `shell: false`).
 */
export type TokenSource = {
    readonly env: string;
} | {
    readonly command: string | readonly string[];
};
export interface TokenResolutionDeps {
    /**
     * Environment lookup map. Defaults to `process.env`. Injectable for tests so
     * unit tests don't depend on ambient environment state.
     */
    readonly env: Record<string, string | undefined>;
    /**
     * Command runner. Defaults to `safeExecResult`-wrapped invocation. Injectable
     * for tests. Receives argv; returns `success` + `stdout`. Should NOT throw
     * for normal exec failures (return `success: false` instead). Throws are
     * propagated by `resolveToken` — they indicate operator-level bugs.
     */
    readonly runCommand: (argv: readonly string[]) => {
        success: boolean;
        stdout: string;
    };
    /**
     * Whether `{ command: ... }` sources are allowed. Defaults to reading
     * `VAT_LINKAUTH_ALLOW_COMMAND` from the resolved `env` map (not ambient
     * `process.env`), so a caller supplying a curated `deps.env` can control the
     * flag without touching real process state. Set to `false` (or set
     * `VAT_LINKAUTH_ALLOW_COMMAND=0` in the env) to skip all command sources and
     * rely solely on env-var sources — useful in locked-down CI or security reviews.
     */
    readonly allowCommand: boolean;
}
/**
 * Return a copy of the given env with all `GIT_*` keys removed. Case-insensitive
 * on the key so Windows env vars (which are case-insensitive at the OS level,
 * though `process.env` preserves original case) can't sneak through as e.g.
 * `Git_Dir`.
 *
 * Exported for unit testing and for callers assembling their own `runCommand`
 * who want the exact same scrub `defaultRunCommand` applies.
 *
 * Rationale: `vat resources validate` is often invoked from git pre-commit
 * hooks, which pre-set `GIT_DIR` / `GIT_WORK_TREE` / `GIT_INDEX_FILE`. These
 * poison any nested tool that shells out to git, notably `gh auth token`.
 */
export declare function scrubGitEnv(source: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
/**
 * Default `runCommand` implementation — exported so callers that want to
 * memoize per-validate-run can wrap it without duplicating the spawn logic.
 * Forwards to `safeExecResult` (no shell, argv-based), with `GIT_*` vars
 * stripped from the child env — see {@link scrubGitEnv}.
 */
export declare const defaultRunCommand: TokenResolutionDeps['runCommand'];
/**
 * Resolve a token from an ordered list of sources.
 *
 * @returns the first non-empty value, or `undefined` if every source failed.
 * @throws whatever the injected `runCommand` throws (operator-level bug; not
 *   swallowed). Standard `safeExecResult` does not throw under normal use.
 */
export declare function resolveToken(sources: readonly TokenSource[], deps?: Partial<TokenResolutionDeps>): string | undefined;
//# sourceMappingURL=resolve-token.d.ts.map