import type { Host } from "../../host/host.js";
export type CredentialSources = {
    env: Record<string, string | undefined>;
    ghAuthToken: () => Promise<string | null>;
    keyringGet: (key: string, service: string) => Promise<string | null>;
};
/** Precedence: env, then gh, then keyring. Pure over its sources so tests
 *  can prove the order with a different value per source. Throws on a miss. */
export declare function resolveTokenFromSources(sources: CredentialSources): Promise<string>;
export declare function _resetGithubCredentialCacheForTests(): void;
/** Forget the cached token. Called on a 401 so the remedies in that failure
 *  message (a new gh login, a new GITHUB_TOKEN, a new keyring entry) take
 *  effect on the next call instead of after a restart. */
export declare function invalidateGithubCredentialCache(): void;
/** The cache layer over the precedence logic, injectable so tests can drive
 *  the cache with fake sources and never touch a real credential. */
export declare function _resolveAndCache(host: Host, sources: CredentialSources): Promise<string>;
/** The token for GitHub requests. Called ONLY by _githubRequest, after the
 *  operation's interrupt is approved — never from Agency. The invariant:
 *  nothing reads the token without an approved interrupt in front of it. */
export declare function resolveGithubToken(host: Host): Promise<string>;