import type { CredentialResolution } from "./authEnv.js";
import { type CredentialId } from "./credential-id.js";
import type { ProviderConfig, ResolvedTarget, CredentialSlot, ProviderCredentialConfig } from "./config-types.js";
import type { KeystoreOptions } from "./keystore.js";
export type { CredentialSlot, ProviderCredentialConfig };
export interface ResolvedCredentialSlot {
    readonly slot: CredentialSlot;
    readonly resolution: CredentialResolution;
}
/** Application-layer attempt with credential resolution performed exactly once. */
export interface ResolvedAttempt {
    readonly target: ResolvedTarget;
    readonly credentialId: CredentialId;
    readonly credential: CredentialResolution;
    /** Non-secret slot descriptor; the secret itself remains only in `credential.value`. */
    readonly slot: CredentialSlot;
}
/** The implicit one-slot view retained for old providers and hand-built targets. */
export declare function implicitCredentialSlot(provider: string, authEnv?: string): CredentialSlot;
/** Sentinel used only by legacy callers that still require an attempt object for an empty fleet. */
export declare function emptyCredentialSlot(provider: string): CredentialSlot;
/** Normalize a provider's already-validated configuration into stable slot descriptors. */
export declare function providerCredentialSlots(provider: string, config: ProviderConfig): readonly CredentialSlot[];
export declare function slotAllowsModel(slot: CredentialSlot, model: string | undefined): boolean;
export declare function resolveCredentialSlot(slot: CredentialSlot, env?: NodeJS.ProcessEnv, keystoreOptions?: KeystoreOptions): CredentialResolution;
export declare function snapshotProviderCredentials(provider: string, config: ProviderConfig, env?: NodeJS.ProcessEnv, keystoreOptions?: KeystoreOptions): readonly ResolvedCredentialSlot[];
/** True when an enabled slot can make an egress attempt (or is an intentional passthrough). */
export declare function aggregateHasKey(provider: string, config: ProviderConfig, env?: NodeJS.ProcessEnv, keystoreOptions?: KeystoreOptions): boolean;
/** Resolve one slot into an attempt, refusing disabled, model-scoped-out, and missing slots. */
export declare function resolveAttemptForSlot(target: ResolvedTarget, slot: CredentialSlot, env?: NodeJS.ProcessEnv, keystoreOptions?: KeystoreOptions): ResolvedAttempt | undefined;