/**
 * crew#720: the deliver phase's provider credentials — ONE preflight shape for GitHub and Azure
 * DevOps — and the Azure DevOps repository a remote URL names.
 *
 * Only PRESENCE is read here, never a value: the credential stays in the daemon's environment
 * (or gh's keyring) and is consumed by the deliver script alone, inside the deliver phase (the
 * engine strips every forge credential from worker seats, wicked-core#671).
 *
 * The same check runs twice: at launch (so the deliver gate card says "<provider> credentials not
 * configured" BEFORE approval, and `GET /repos/:id/deliver-target` reports it) and in the deliver
 * script itself before anything is staged, whose refusal parks the run at the engine's
 * deliver-refusal gate with the work kept ({@link DELIVER_CREDENTIALS_MISSING_MARKER}).
 */
/** The forge a delivery goes to. `null` from {@link deliverProviderOf} = neither (a local path,
 *  GitLab, Gitea, …): the push-only path, which needs no provider credential of crew's. */
export type DeliverProvider = 'github' | 'azure_devops';
/** api-types `DeliverCredentials` (crew#720) — the one preflight shape every provider shares. */
export interface DeliverCredentials {
    provider: DeliverProvider;
    /** `unknown` = the probe could not answer (gh timed out); never read as `missing`. */
    status: 'configured' | 'missing' | 'unknown';
    /** Where the credential comes from when configured; `null` otherwise. */
    source: 'gh_token' | 'gh_login' | 'service_principal' | 'pat' | null;
    /** What to set when `missing`, in the order the phase tries them (env var names, commands). */
    missing: string[];
    /** One sentence for the gate card and the run record. */
    message: string;
}
/** The env var names the Azure DevOps delivery reads (service principal first, then the PAT). */
export declare const ADO_SP_ENV: readonly ["CREW_ADO_TENANT_ID", "CREW_ADO_CLIENT_ID", "CREW_ADO_CLIENT_SECRET"];
export declare const ADO_PAT_ENV = "AZURE_DEVOPS_EXT_PAT";
/**
 * The line the deliver script prints when the provider credential is absent:
 * `deliver: CREDENTIALS-MISSING <provider>` — before anything is staged, followed by the
 * push-refused marker so the engine parks the run at its deliver-refusal gate.
 */
export declare const DELIVER_CREDENTIALS_MISSING_MARKER = "deliver: CREDENTIALS-MISSING";
/** The Azure DevOps credential the daemon environment holds (presence only). */
export declare function adoCredentials(env?: NodeJS.ProcessEnv): DeliverCredentials;
/**
 * The GitHub credential: an exported `GH_TOKEN`, else a gh login for github.com. `logins` is
 * `gh auth status`'s answer — `[]` = gh answered with no login, `'absent'` = gh is not installed,
 * `null` = the probe could not answer (unknown, never missing). (crew#940) With a push identity
 * configured (`account`), only THAT account's own gh login counts: the phase reads its token by
 * name, so another account signed in to gh is no credential for this delivery.
 */
export declare function githubCredentials(env: NodeJS.ProcessEnv, logins: readonly string[] | 'absent' | null, account?: string | null): DeliverCredentials;
/** The Azure DevOps repository a remote URL names. */
export interface AdoRepo {
    org: string;
    project: string;
    repo: string;
    /** The canonical https git URL every authenticated fetch/push goes to. */
    gitUrl: string;
    /** `…/_apis/git/repositories/<repo>` — the REST base for pull requests. */
    apiBase: string;
    /** The repository's web URL; a PR is `<webUrl>/pullrequest/<id>`. */
    webUrl: string;
    /** The Entra token authority (service-principal mint). */
    loginBase: string;
}
/** Is `host` an Azure DevOps host (`dev.azure.com`, `ssh.dev.azure.com`, `*.visualstudio.com`)? */
export declare function isAdoHost(host: string | null): boolean;
/**
 * The Azure DevOps repository of a remote URL, or `null`. Accepts the four spellings Azure DevOps
 * hands out — `https://[user@]dev.azure.com/<org>/<project>/_git/<repo>`,
 * `https://<org>.visualstudio.com/[DefaultCollection/]<project>/_git/<repo>`,
 * `git@ssh.dev.azure.com:v3/<org>/<project>/<repo>` and
 * `<org>@vs-ssh.visualstudio.com:v3/<org>/<project>/<repo>` — and nothing looser. Userinfo is
 * never kept. Every part is percent-decoded once and re-encoded, so the canonical URL is stable.
 */
export declare function adoRepoOf(url: string | null | undefined): AdoRepo | null;
/** The provider a delivery to `originUrl` uses, or `null` (push-only / local / unknown). */
export declare function deliverProviderOf(originUrl: string | null | undefined): DeliverProvider | null;
/** The credential preflight a deliver card shows for an origin; `null` when no provider applies. */
export declare function deliverCredentialsFor(originUrl: string | null | undefined, env: NodeJS.ProcessEnv, ghLogins: readonly string[] | 'absent' | null, account?: string | null): DeliverCredentials | null;
/** `deliver: CREDENTIALS-MISSING <provider>` in a deliver transcript → that provider, else `null`.
 *  The LAST such line decides; the script prints it before anything reaches the remote. */
export declare function credentialsMissingIn(text: string): DeliverProvider | null;
/**
 * {@link deliverCredentialsFor} with the gh probe run only when it can matter: a github.com origin
 * with no exported GH_TOKEN (a bounded `gh auth status`, crew#737's probe). gh not installed reads
 * `'absent'`; a probe that timed out reads unknown. Never throws.
 */
export declare function deliverCredentialsProbe(originUrl: string | null | undefined, env: NodeJS.ProcessEnv, probe?: () => Promise<string[] | 'absent' | null>, 
/** (crew#940) The configured push identity (setting / repo pin / `GH_ACCOUNT`), `null` = none. */
account?: string | null): Promise<DeliverCredentials | null>;
export declare function ghLoginsOrAbsent(): Promise<string[] | 'absent' | null>;
/** The canonical `missing` reading for a provider — what the run record says after the deliver
 *  phase refused for want of the credential (the phase read the environment it ran in). */
export declare function missingCredentials(provider: DeliverProvider): DeliverCredentials;
//# sourceMappingURL=deliver-credentials.d.ts.map