import type { DiagnosticHandler } from "./types.js";
/**
 * Base shape of an insforge credentials record. Sinks may extend this with
 * their own fields (e.g. SAL adds `cleanup_stale_runs`); use the generic
 * parameter on loadInsforgeCredentials to type those extra fields safely.
 */
export interface InsforgeCredentialsBase {
    endpoint?: string;
    /** Legacy alias for `endpoint` — both formats are produced by older configs. */
    insforge_url?: string;
    api_key?: string;
    anon_key?: string;
    api_key_header?: string;
    headers?: Record<string, string>;
    allow_self_signed?: boolean;
    enabled?: boolean;
}
/**
 * Walks a prioritized list of candidate paths (workspace overrides home dir) and
 * returns the first usable credentials record. Returns null when nothing is found
 * or all files are unparseable.
 *
 * `source` is folded into emitted diagnostics so SAL keeps emitting
 * `sal.eval:...` fingerprints and a future ext-telemetry sink emits
 * `ext.telemetry:...` without changing this loader.
 */
export declare function loadInsforgeCredentials<T extends InsforgeCredentialsBase = InsforgeCredentialsBase>(workspaceRoot: string, source: string, onDiagnostic?: DiagnosticHandler, extraEnvPath?: string): T | null;