/**
 * Runner-side cloud credential bundle resolution.
 *
 * The platform delivers per-cloud secret bundles env-keyed in the
 * `session_init` secrets map (contract keys live in
 * `CLOUD_SECRET_ENV_KEYS`, bridge). This module picks the bundle for the
 * session's effective cloud and materializes the Vertex service-account JSON
 * to a 0600 file so the raw blob never rides `AgentConfig.cloudSecrets`.
 */
/**
 * Pick the contract credential bundle for `cloud` out of the `session_init`
 * secrets map. Unrelated secrets (connector tokens, provider API keys) are
 * ignored; missing bundle keys are simply absent from the result.
 *
 * When the raw Vertex SA JSON is present it is written to
 * `<projectDir>/.skaile/gcp-sa.json` (mode 0600) and the returned bundle
 * carries `GOOGLE_APPLICATION_CREDENTIALS` (the absolute file path) instead —
 * the raw JSON never enters `cloudSecrets`. Values are secrets: never logged.
 *
 * @since 1.3.0
 */
export declare function resolveCloudSecretBundle(args: {
    cloud: string;
    secrets: Record<string, string | undefined> | undefined;
    projectDir: string;
}): {
    cloudSecrets: Record<string, string>;
};
/**
 * Best-effort removal of credential files materialized by
 * {@link resolveCloudSecretBundle}. Safe to call when nothing was written.
 *
 * @since 1.3.0
 */
export declare function cleanupCloudCredentialFiles(projectDir: string): void;
//# sourceMappingURL=cloud-bundle.d.ts.map