import type { LocalIntegrationCredentialProvider } from "./local-tool-source.js";
import type { IntegrationConfig } from "./schema.js";
import { type LocalIntegrationEndpointTransport } from "./local-endpoint-executor.js";
interface LocalCredentialAuthPlanBase {
    readonly connectorName: string;
    readonly requiredEnvironmentVariables: readonly string[];
}
interface LocalApiKeyAuthPlan extends LocalCredentialAuthPlanBase {
    readonly kind: "api-key";
    readonly keyName: string;
    readonly headerName: string;
    readonly headerPrefix?: string;
    readonly additionalHeaders: Readonly<Record<string, string>>;
}
interface LocalBasicAuthPlan extends LocalCredentialAuthPlanBase {
    readonly kind: "basic";
    readonly usernameName: string;
    readonly passwordName: string;
    readonly passwordFallback?: string;
    readonly additionalHeaders: Readonly<Record<string, string>>;
}
interface LocalClientCredentialsAuthPlan extends LocalCredentialAuthPlanBase {
    readonly kind: "client-credentials";
    readonly additionalParams: Readonly<Record<string, string>>;
    readonly clientIdName: string;
    readonly clientSecretName: string;
    readonly scopes: readonly string[];
    readonly tokenAuthMethod: "basic" | "request-body";
    readonly tokenUrl: string;
}
interface LocalSalesforceServiceAccountAuthPlan extends LocalCredentialAuthPlanBase {
    readonly kind: "salesforce-service-account";
    readonly clientIdName: "SALESFORCE_SERVICE_ACCOUNT_CLIENT_ID";
    readonly clientSecretName: "SALESFORCE_SERVICE_ACCOUNT_CLIENT_SECRET";
    readonly loginUrlName: "SALESFORCE_SERVICE_ACCOUNT_LOGIN_URL";
}
export type LocalCredentialAuthPlan = LocalApiKeyAuthPlan | LocalBasicAuthPlan | LocalClientCredentialsAuthPlan | LocalSalesforceServiceAccountAuthPlan;
export interface ResolvedLocalHeaderAuth {
    readonly kind: "headers";
    readonly connectorName: string;
    readonly headers: Readonly<Record<string, string>>;
}
export interface ResolvedLocalTokenRequest {
    readonly kind: "token-request";
    readonly connectorName: string;
    readonly mode: "client-credentials" | "salesforce-service-account";
    readonly url: string;
    readonly headers: Readonly<Record<string, string>>;
    readonly body: string;
}
export type ResolvedLocalCredentialAuth = ResolvedLocalHeaderAuth | ResolvedLocalTokenRequest;
export interface ResolvedLocalExecutionAuth {
    readonly headers: Readonly<Record<string, string>>;
    readonly instanceOrigin?: string;
}
/** Build a serializable, value-free credential plan from trusted catalog metadata. */
export declare function createLocalCredentialAuthPlan(connector: Pick<IntegrationConfig, "auth" | "envVars" | "name">): LocalCredentialAuthPlan;
/** Resolve short-lived secret values for a previously validated auth plan. */
export declare function resolveLocalCredentialAuth(plan: LocalCredentialAuthPlan, provider: LocalIntegrationCredentialProvider): Promise<ResolvedLocalCredentialAuth>;
/** Mint a short-lived bearer credential from a previously resolved local auth request. */
export declare function mintLocalCredentialAuth(resolved: ResolvedLocalCredentialAuth, toolId: string, signal?: AbortSignal, transport?: LocalIntegrationEndpointTransport): Promise<ResolvedLocalExecutionAuth>;
export {};
//# sourceMappingURL=local-credential-auth.d.ts.map