/** Read the injected base URL of the Kazzle API for install-secret calls. */
export declare function kazzleApiUrl(): string;
/** Env var name Kazzle injects for a sibling component's internal URL. */
export declare function componentUrlEnvName(componentName: string): string;
/**
 * Resolve a sibling component's internal URL. Throws if the platform has not
 * injected it (start the named component first) — there is no fallback, because
 * a wrong/empty address makes cross-component calls fail silently.
 */
export declare function componentUrl(componentName: string): string;
/** Header Kazzle sets to carry the verified install identity into the app. */
export declare const KAZZLE_IDENTITY_HEADER = "x-kazzle-identity";
/**
 * Extract the install identity token from an incoming tool request. Kazzle
 * delivers it in `X-Kazzle-Identity`; the app's own `Authorization` header is
 * left untouched for the app's own use.
 */
export declare function installIdentityToken(req: Request): string;
/**
 * Client scoped to one install, built from the identity token on an incoming
 * tool request. Use it to persist and read per-install runtime secrets.
 */
export declare class KazzleInstallClient {
    private readonly token;
    private readonly apiUrl;
    constructor(reqOrIdentityToken: Request | string);
    private authHeader;
    /** Read a per-install secret by fixed name. Returns null when not set yet (404). */
    getSecret(name: string): Promise<string | null>;
    /** Write a per-install secret by fixed name. */
    setSecret(name: string, value: string): Promise<void>;
}