import type { CloudAgent } from "./agent-protocol.js";
export type CloudIntegration = Readonly<{
    agent: CloudAgent;
    configPath: string;
    origin: string;
    apiKeyId: string;
    /** Repository policy binding; absent on legacy and unbound installations. */
    repositoryConnectionId?: string;
    /** Absent on older installations, which use the legacy credential slot. */
    credentialVersion?: 2;
}>;
export type PendingCloudRevocation = Readonly<{
    origin: string;
    apiKeyId: string;
}>;
/** Durable removal of a retired private SecretStore slot, independent of remote revocation. */
export type PendingCloudCredentialCleanup = CloudIntegration;
export type CloudState = Readonly<{
    version: 1;
    activeOrigin?: string;
    integrations: readonly CloudIntegration[];
    pendingRevocations?: readonly PendingCloudRevocation[];
    pendingCredentialCleanups?: readonly PendingCloudCredentialCleanup[];
}>;
type Options = {
    home?: string;
    lockHeld?: boolean;
};
export declare function acquireCloudStateLock(options?: Options): Promise<import("@velum-labs/routekit-runtime/service").LifecycleLock>;
export declare function readCloudState(options?: Options): CloudState;
export declare function setCloudActiveOrigin(activeOrigin: string | undefined, options?: Options): Promise<void>;
export declare function getCloudIntegration(agent: CloudAgent, configPath: string, options?: Options): CloudIntegration | undefined;
export declare function listCloudIntegrations(options?: Options): readonly CloudIntegration[];
export declare function cloudApiKeyIsActive(keyOrigin: string, apiKeyId: string, options?: Options): boolean;
export declare function listPendingCloudCredentialCleanups(options?: Options): readonly PendingCloudCredentialCleanup[];
/** Check the private slot, not only the key ID: legacy installs share one slot across rotations. */
export declare function cloudCredentialCleanupIsActive(cleanup: PendingCloudCredentialCleanup, options?: Options): boolean;
/** A cleanup record is retired only after the SecretStore deletion succeeded. */
export declare function deletePendingCloudCredentialCleanup(cleanup: PendingCloudCredentialCleanup, options?: Options): Promise<void>;
export declare function removeCloudIntegrationAndQueueRevocation(integration: CloudIntegration, options?: Options): Promise<void>;
export declare function listPendingCloudRevocations(options?: Options): readonly PendingCloudRevocation[];
export declare function queueCloudRevocation(revocation: PendingCloudRevocation, options?: Options): Promise<void>;
export declare function deletePendingCloudRevocation(revocation: PendingCloudRevocation, options?: Options): Promise<void>;
export declare function commitCloudIntegration(integration: CloudIntegration, options: Options & {
    activatedApiKeyId: string;
    replaced?: PendingCloudRevocation;
}): Promise<void>;
export {};