import { RouteKitFailure } from "@velum-labs/routekit-runtime/effect";
import { type SecretStoreService } from "@velum-labs/routekit-runtime/secret-store";
import { Effect } from "effect";
import type { CloudAgent } from "./agent-protocol.js";
import type { CloudIntegration } from "./state.js";
export type { CloudAgent } from "./agent-protocol.js";
type Options = {
    home?: string;
    secretStore?: SecretStoreService;
};
/** OAuth session and installed agent keys share private storage, not public Cloud state. */
export declare const cloudSessionSecret: (origin: string, options?: Options) => {
    read: () => Effect.Effect<string | undefined, RouteKitFailure>;
    write: (value: string) => Effect.Effect<void, RouteKitFailure>;
    remove: () => Effect.Effect<void, RouteKitFailure>;
};
export declare const cloudAgentCredential: (agent: CloudAgent, origin: string, configPath: string, options?: Options) => {
    read: () => Effect.Effect<string | undefined, RouteKitFailure>;
    write: (value: string) => Effect.Effect<void, RouteKitFailure>;
    remove: () => Effect.Effect<void, RouteKitFailure>;
};
/** Prepared keys live in separate secret slots; activating one never overwrites the old key. */
export declare const cloudVersionedAgentCredential: (agent: CloudAgent, origin: string, configPath: string, apiKeyId: string, options?: Options) => {
    read: () => Effect.Effect<string | undefined, RouteKitFailure>;
    write: (value: string) => Effect.Effect<void, RouteKitFailure>;
    remove: () => Effect.Effect<void, RouteKitFailure>;
};
/** The persisted active pointer, never a pending install, selects the helper credential. */
export declare const cloudActiveAgentCredential: (integration: CloudIntegration, options?: Options) => {
    read: () => Effect.Effect<string | undefined, RouteKitFailure>;
    write: (value: string) => Effect.Effect<void, RouteKitFailure>;
    remove: () => Effect.Effect<void, RouteKitFailure>;
};
/** Protected recovery record, scoped to one Cloud origin and enrollment. */
export declare const cloudSetupRecovery: (origin: string, enrollmentId: string, options?: Options) => {
    read: () => Effect.Effect<string | undefined, RouteKitFailure>;
    write: (value: string) => Effect.Effect<void, RouteKitFailure>;
    remove: () => Effect.Effect<void, RouteKitFailure>;
};