/**
 * Where `secret=` gets its bytes, and why it is spelled three ways.
 *
 * The secret is the one thing in a run that must not travel: it never goes on
 * the wire (only a signature derived from it does) and it should not travel into
 * version control either, which is what a config does. So the two spellings that
 * keep it out of the file come first, and the literal is accepted with a warning
 * rather than refused — a service on 127.0.0.1 for an afternoon is a real use,
 * and refusing it would only teach people to work around the check.
 *
 *   secret="env:TDC_HTTP_SECRET"    read from the environment
 *   secret="file:~/.tdc/service.key"  read from a file, trimmed
 *   secret="k7Fm2p…"                 the value itself — TDC284
 *
 * Resolution lives here rather than in the client because it touches the
 * environment and the filesystem, and the client is a pure function of its
 * arguments — which is what lets the shared cases sign a request without a
 * machine's environment leaking into the expectation.
 */
/** Why a `secret=` could not be turned into bytes. The caller names the sequence. */
export declare class HttpSecretError extends Error {
    constructor(message: string);
}
/**
 * `secret="…"` → the bytes to sign with.
 *
 * `baseDir` is the config's own directory, so `file:service.key` beside the
 * config means what it looks like. An empty or whitespace-only secret is refused
 * wherever it came from: signing with nothing would produce a signature every
 * caller could forge, which is worse than not signing at all.
 */
export declare function resolveHttpSecret(spec: string, baseDir: string, env?: NodeJS.ProcessEnv): string;
//# sourceMappingURL=http-secret.d.ts.map