import type { NodeKeyPair } from '@forgezero/runtime/identity';
import { type SecretCache } from './cache';
import { type SignedNodeHttpOptions } from './signed-node-http';
import type { AgentOperationTelemetry } from './telemetry-runtime';
import { type DeploymentVaultBindingV3, type DeploymentVaultBindingsV3 } from '@forgezero/access/vault';
export interface NodeVaultOptions extends Omit<SignedNodeHttpOptions, 'apiUrl'> {
    /** Realm-selected node base, for example https://api.example/api/t/acme. */
    apiUrl: string;
    keys: NodeKeyPair;
    /** Complete exact binding set sealed into the active native release claim. */
    bindings: DeploymentVaultBindingsV3;
    ttlMs?: number;
    maxStaleMs?: number;
}
/** Opaque in-memory key for one API-approved deployment binding. */
export declare function deploymentVaultCacheKey(binding: DeploymentVaultBindingV3): string;
export declare function deploymentVaultBinding(key: string): DeploymentVaultBindingV3;
/** Turn the public API origin into the realm-selected node endpoint. */
export declare function realmNodeApiUrl(apiUrl: string, realmSlug: string): string;
/** The server-approved V3 binding is the only address an Agent can read. */
export declare function createNodeVaultCache(options: NodeVaultOptions): SecretCache;
export interface NodeVaultSyncOptions {
    intervalMs?: number;
    setTimer?: (callback: () => void, ms: number) => unknown;
    clearTimer?: (handle: unknown) => void;
    onEvent?: (event: string, detail?: unknown) => void;
    telemetry?: AgentOperationTelemetry;
}
/** Poll rotation cursors without overlapping calls; stop waits for the active sync. */
export declare function startNodeVaultSync(cache: SecretCache, options?: NodeVaultSyncOptions): {
    stop(): Promise<void>;
};