/**
 * AI cloud-provider transport dimension for the `claude-sdk` driver.
 *
 * `cloud` is a config axis orthogonal to `provider` (model vendor) and
 * `driver` (agent runtime). Under `driver: claude-sdk` each non-default value
 * maps to one of the Claude Agent SDK's native env-var transports:
 * Amazon Bedrock, Google Vertex AI, Azure AI Foundry, or a generic
 * `ANTHROPIC_BASE_URL` gateway (LiteLLM / corporate proxy).
 *
 * Cross-repo contract: env key names and semantics here are load-bearing —
 * the platform resolves credential bundles against the same key set.
 */
/**
 * Canonical list of supported cloud transports. `"default"` (or an absent
 * `cloud` field) means the provider's native API — today's behavior, unchanged.
 *
 * The codec in `core/workspace-config.ts` keeps a local copy (`KNOWN_CLOUDS`)
 * to avoid an import cycle; a drift test asserts parity.
 *
 * @since 1.3.0
 */
export declare const SUPPORTED_CLOUDS: readonly ["default", "bedrock", "vertex", "azure", "gateway"];
/** One of the supported cloud transport identifiers. */
export type CloudId = (typeof SUPPORTED_CLOUDS)[number];
/**
 * Non-secret transport settings for a cloud. Sourced from skaile.yaml
 * `cloud_config` (snake_case on the wire, camelCase in-process — converted
 * exactly once at the settings/serve boundary).
 *
 * Must stay field-identical with core's `CloudTransportConfig` and the inline
 * `AgentSessionConfig.cloudConfig` shape (kept separate to avoid a core↔bridge
 * import cycle) — a field added here must be added there too.
 *
 * @since 1.3.0
 */
export interface CloudConfig {
    /** bedrock: AWS region (`AWS_REGION`); vertex: `CLOUD_ML_REGION`. */
    region?: string;
    /** vertex only: GCP project (`ANTHROPIC_VERTEX_PROJECT_ID`). */
    projectId?: string;
    /** azure only: Foundry resource name (`ANTHROPIC_FOUNDRY_RESOURCE`). */
    resource?: string;
    /** azure (alternative to `resource`) / gateway (required): endpoint base URL. */
    baseUrl?: string;
}
/**
 * Secret env keys that make up the credential bundle for each non-default
 * cloud. The platform delivers these env-keyed in the `session_init` secrets
 * map; the runner picks them out via `resolveCloudSecretBundle`.
 *
 * Vertex note: `GOOGLE_APPLICATION_CREDENTIALS_JSON` is our convention for the
 * raw service-account JSON blob. The runner materializes it to a 0600 file and
 * hands the driver `GOOGLE_APPLICATION_CREDENTIALS` (a path) instead — the
 * driver never sees the raw JSON.
 *
 * @since 1.3.0
 */
export declare const CLOUD_SECRET_ENV_KEYS: Record<Exclude<CloudId, "default">, readonly string[]>;
/**
 * Assemble the Claude Agent SDK child env for a non-default cloud transport.
 *
 * Pure function (no external state touched; the returned `env` is a fresh
 * object — inputs are never mutated): starts from `baseEnv` (caller passes a
 * copy of `process.env` with undefined stripped) merged with `configEnv`,
 * scrubs inherited Anthropic
 * credential/routing vars and every `CLAUDE_CODE_USE_*` flag, then sets exactly
 * one `CLAUDE_CODE_USE_*` flag (none for gateway) plus the cloud's credential
 * bundle and derived non-secret vars. AWS_* / GOOGLE_* ambient values are NOT
 * scrubbed, so a standalone CLI inherits ambient cloud credentials when no
 * explicit `cloudSecrets` bundle is provided. Gateway is the mirror case: its
 * carriers ARE the scrubbed Anthropic vars, so the gateway branch restores
 * them from `cloudSecrets` → `fallbackApiKey` (resolved `apiKeys.anthropic`)
 * → the pre-scrub config/ambient value — otherwise a standalone gateway
 * session would have no reachable auth carrier at all.
 *
 * Never returns `undefined` values; absent settings are simply omitted.
 *
 * @since 1.3.0
 */
export declare function buildClaudeCloudEnv(args: {
    cloud: Exclude<CloudId, "default">;
    cloudConfig?: CloudConfig;
    cloudSecrets?: Record<string, string>;
    baseEnv: Record<string, string>;
    configEnv?: Record<string, string>;
    /** Resolved API key (e.g. `apiKeys.anthropic`) — gateway auth fallback only. */
    fallbackApiKey?: string;
}): Record<string, string>;
//# sourceMappingURL=cloud.d.ts.map