/**
 * credentialRef support: compose a proxyUrl with a secret fetched from the
 * DSH credentials service, keeping plaintext passwords out of the profile config.
 *
 * The credentials service is a SOFT dependency (dsh-llm-deepseek follows the
 * same pattern): it is looked up via ctx.get('credentials') at runtime, never
 * declared in `inject`, so installs without the credentials package keep
 * working as long as no rule references a credentialRef.
 */
/**
 * Merge `secret` into `baseUrl`'s userinfo. Secret format is
 * "username:password" (split at the FIRST colon so passwords may contain
 * colons). Returns undefined for unparseable input.
 */
export declare function composeProxyUrl(baseUrl: string, secret: string): string | undefined;
/** Minimal structural face of the DSH credentials service we rely on. */
export interface CredentialLookup {
    resolve(ref: string): Promise<{
        value: string;
    } | undefined>;
}
/** Safely fetch the soft 'credentials' service; undefined when absent. */
export declare function getCredentialsService(ctx: unknown): CredentialLookup | undefined;
//# sourceMappingURL=credentials.d.ts.map