/**
 * Secret custody, CLI side (design §5c.1; build-plan slice 3.5). Values go server-side via
 * `PUT /v1/builder/hosted-agents/:id/secrets/:name` — never argv, never the bundle, never at
 * rest locally. This module owns the three API calls and the local `.env` lookup that powers
 * the wizard's "use your local value?" import (per-key consent lives with the caller).
 * Workspace/agent resolution moved to `workspace-target.ts` in R5 — every post-deploy command
 * shares one ladder.
 */
import { type CliApiDeps } from "./api-client";
/** This domain speaks to the API through the shared client (R5). */
export type SecretsDeps = CliApiDeps;
/** The agent isn't known to the hosting side yet — on a FIRST deploy the binding lands with
 * the first release push, so pre-upload secret calls answer 404. Typed so the deploy wizard
 * can defer its preflight to after the upload instead of dying (gate-run finding 2026-07-30). */
export declare class SecretsNotBoundError extends Error {
    constructor();
}
export declare function setSecret(deps: SecretsDeps, agentId: string, name: string, value: string): Promise<void>;
export declare function unsetSecret(deps: SecretsDeps, agentId: string, name: string): Promise<void>;
export declare function listSecretNames(deps: SecretsDeps, agentId: string): Promise<string[]>;
/**
 * The workspace's local value for an env NAME, if any — the "use the same value as your
 * local .env?" source (design §5c.1). Reads `KEY=value` lines (quotes stripped); malformed
 * or unreadable files are simply not a source. The value never leaves this process except
 * via the consented setSecret call.
 */
export declare function readLocalEnvValue(workspacePath: string, name: string): string | undefined;