import type { DaemonStatus } from "@velum-labs/routekit-control";
import { RouteKitFailure } from "@velum-labs/routekit-runtime/effect";
import { Effect } from "effect";
import { type RouteKitRemote } from "../remotes.js";
export type EvalCandidateTrialTargetIdentity = {
    readonly targetIdentity: string;
    readonly targetSelectionDigest: string;
};
export type EvalCandidateTrialTargetSelection = {
    readonly kind: "local";
    readonly runtimeHome: string;
    readonly routerConfigPath: string;
} | {
    readonly kind: "remote";
    readonly name: string;
    readonly gatewayUrl: string;
    readonly sshHost: string;
    /** Public credential identity, never credential material. */
    readonly tokenId: string;
};
/**
 * A generation number is only unique within one daemon owner. Bind the actual
 * selected owner and authenticated public runtime/config identity as well.
 * This digest is not a new control identity, credential, or execution receipt.
 */
export declare function evalCandidateTrialTargetIdentity(selection: EvalCandidateTrialTargetSelection, daemon: DaemonStatus): EvalCandidateTrialTargetIdentity;
/** Public selection only: no credential lookup, client resolution or daemon recovery. */
export declare const readEvalCandidateTrialTargetSelection: () => Effect.Effect<EvalCandidateTrialTargetSelection, RouteKitFailure, never>;
/**
 * Validate the cache against the public owner captured by its transport owner.
 * An unbound or mismatched cache is not permission to resolve another client.
 * The returned remote is the captured immutable SSH-hop metadata, not a fresh
 * registry lookup that could name a different target.
 */
export declare const readEvalCandidateTrialTargetBinding: () => Effect.Effect<{
    resolved: import("../cli-session.js").ResolvedTelemetryTarget;
    provenance: import("../cli-session.js").ResolvedTelemetryTargetProvenance;
    selection: EvalCandidateTrialTargetSelection;
    targetSelection: {
        local: boolean;
        remote?: string;
    };
    remote: Readonly<RouteKitRemote> | undefined;
}, RouteKitFailure, never>;
/**
 * Requires the workflow's already selected authenticated client. Revalidation
 * must not resolve credentials again, auto-start a daemon, or change owners.
 */
export declare const readEvalCandidateTrialTargetIdentity: () => Effect.Effect<EvalCandidateTrialTargetIdentity, Error, import("effect/unstable/http/HttpClient").HttpClient>;