import { type ManagedVaultSocketRequest, type ManagedVaultSocketResponse } from '@forgezero/runtime/managed-vault-socket';
export declare class VaultError extends Error {
    readonly code: string;
    constructor(code: string, message: string);
}
export type Credential = {
    mode: 'managed';
    socketPath?: string;
} | {
    mode: 'external';
    apiKey: string;
};
export interface DiscoveryEnvironment {
    env?: Record<string, string | undefined>;
    socketPath?: string;
    socketExists?: (path: string) => boolean;
}
/** The attested Agent socket; it resolves aliases against its exact V3 claim. */
export declare const DEFAULT_SOCKET = "/run/forgezero/vault.sock";
/** Prefer managed Agent access. An external seed is never a fallback for a failed socket request. */
export declare function discover(environment?: DiscoveryEnvironment): Credential;
export interface SignRequest {
    method: string;
    path: string;
    query: string;
    body: string;
    responseKey?: string;
}
export interface Signer {
    readonly keyId: string;
    sign(request: SignRequest): Promise<string>;
}
/**
 * `fz.<key-id>.<seed>` is the only accepted credential syntax. Accepting a
 * mode-prefixed legacy key would make an old sandbox/project authority look
 * like a valid Deployment credential before the server gets to reject it.
 */
export declare function signerFromApiKey(secret: string): Signer;
/** Shared with the Agent. The only accepted local request is one alias. */
export type AgentRequest = ManagedVaultSocketRequest;
export type AgentResponse = ManagedVaultSocketResponse;
export type AgentTransport = (socketPath: string, request: AgentRequest) => Promise<AgentResponse>;
/** Local reads are not retried: a handover/unavailable Agent is visible, not a hidden request loop. */
export declare const managedAgentTransport: AgentTransport;
export interface VaultOptions {
    /** Stable public API origin. Node topology is never exposed to applications. */
    apiUrl?: string;
    /** Complete fetch plus response-body deadline. Maximum is twenty seconds. */
    requestTimeoutMs?: number;
    /** Required native Deployment identity; there is no Project fallback/default. */
    deploymentKey: string;
    /** Required declared Deployment environment; there is no default environment. */
    environmentKey: string;
    fetch?: typeof globalThis.fetch;
    signer?: Signer;
    agentTransport?: AgentTransport;
    credential?: Credential;
    discovery?: DiscoveryEnvironment;
}
export declare const DEFAULT_API_URL = "https://api.forgezero.net";
export declare const DEFAULT_REQUEST_TIMEOUT_MS = 20000;
export declare class ForgeZero {
    readonly credential: Credential;
    private readonly apiUrl;
    private readonly doFetch;
    private readonly signer?;
    private readonly agentTransport;
    private readonly requestTimeoutMs;
    private readonly deploymentKey;
    private readonly environmentKey;
    constructor(options: VaultOptions);
    private path;
    /**
     * One deadline spans DNS/fetch, headers, and JSON body consumption. A
     * response that sends headers then stalls cannot wedge startup forever.
     */
    private externalRead;
    private managedRead;
    /** Read exactly one currently bound alias. No broad list, history, write, or runtime operation exists. */
    get<T = unknown>(alias: string): Promise<T>;
}
/** The documented construction point; direct coordinate fields are mandatory. */
export declare const createVault: (options: VaultOptions) => ForgeZero;
export declare function vaultCredentials(vault: ForgeZero): {
    readonly name: string;
    get(reference: string, field: string): Promise<string>;
};
/** Trusted platform code may inject an already-authorized in-process reader. */
export declare function directCredentials(read: (reference: string, field: string) => Promise<string>): {
    readonly name: 'platform-direct';
    get(reference: string, field: string): Promise<string>;
};
export interface SystemdCredentialOptions {
    directory?: string;
    nameFor?: (reference: string, field: string) => string;
    read?: (path: string) => string | undefined;
}
/** Explicit systemd bootstrap roots; discovery never silently downgrades to them. */
export declare function systemdCredentials(options?: SystemdCredentialOptions): {
    readonly name: 'systemd';
    get(reference: string, field: string): Promise<string>;
};
export declare const VERSION = "0.1.42";