/**
 * @license
 * Copyright 2026 Steven Roussey <sroussey@gmail.com>
 * SPDX-License-Identifier: Apache-2.0
 */
/**
 * How a resolved credential is placed onto the outbound request.
 *
 * - `bearer` — `Authorization: Bearer <secret>` (default; OAuth 2.0 style)
 * - `basic`  — `Authorization: Basic <secret>`; the secret is used verbatim and
 *   must already be the base64 of `user:pass`. Nothing is encoded here, so a
 *   caller keeps full control over how the pair is assembled.
 * - `header` — the raw secret as the value of {@link credentialHeaderName}
 *   (API-key style, e.g. `X-Api-Key`)
 * - `none`   — the credential is resolved but never placed on the request
 */
export declare const CredentialSchemes: {
    readonly BEARER: "bearer";
    readonly BASIC: "basic";
    readonly HEADER: "header";
    readonly NONE: "none";
};
export type CredentialScheme = (typeof CredentialSchemes)[keyof typeof CredentialSchemes];
export declare const DEFAULT_CREDENTIAL_SCHEME: CredentialScheme;
export declare const DEFAULT_CREDENTIAL_HEADER = "Authorization";
export interface ApplyCredentialOptions {
    readonly headers: Readonly<Record<string, string>> | undefined;
    readonly credential: string | undefined;
    readonly scheme: CredentialScheme | undefined;
    readonly headerName: string | undefined;
}
/**
 * Returns the header name a scheme writes to, after validating any caller-supplied
 * name. Validation runs even for schemes that ignore `headerName` so a malformed
 * value is reported rather than silently discarded.
 *
 * @throws {TaskConfigurationError} when `headerName` is not a bare header token.
 */
export declare function credentialHeaderName(scheme: CredentialScheme, headerName: string | undefined): string;
/**
 * Places a resolved credential onto a copy of `headers` according to `scheme`.
 *
 * Pure: it never reads a credential store and never mutates its arguments. A
 * resolved credential wins over a same-named header the caller supplied — the
 * credential store is the authoritative source, and letting a hard-coded header
 * shadow it would silently defeat the configured credential.
 *
 * The override is case-INSENSITIVE, because HTTP header names are. A plain
 * `{ ...headers, Authorization: value }` leaves a caller's `authorization` key
 * in place as a distinct object property, and the `Headers` constructor then
 * folds the two into one comma-joined field — sending the caller's stale token
 * alongside the real one and breaking the request.
 *
 * @throws {TaskConfigurationError} when `headerName` is not a bare header token.
 */
export declare function applyCredentialToHeaders(options: ApplyCredentialOptions): Record<string, string> | undefined;