import { type StoreOps } from "@vendoai/core";
import type { EraseReport } from "./erase.js";
import type { VendoStore } from "./store.js";
export interface HostedStoreOptions {
    apiKey: string;
    /** Defaults to the Vendo console; the composition seam passes VENDO_CONSOLE_URL. */
    baseUrl?: string;
    /** Per-request abort timeout, in milliseconds. */
    timeoutMs?: number;
    fetch?: typeof fetch;
}
/** The hosted store handle: a plain StoreAdapter over the console wire, plus
 * the erase door (02-store §5 — the console cascades exactly like eraseStore;
 * the host-side TTL sweep is built on this call). `ensureSchema` is a client
 * no-op (the service owns its migrations), `close` holds no local resources,
 * and `raw()` fails loudly — there is no local database handle to hand out. */
export interface HostedStore extends VendoStore {
    erase: {
        bySubject(subject: string): Promise<EraseReport>;
        byApp(appId: string): Promise<EraseReport>;
    };
    /** The 50-op named-operation surface over the same mount and the same key —
     * `vendo/store-wire@1` (see {@link hostedStoreOps}). The StoreAdapter doors
     * above are built ON these ops. */
    ops: StoreOps;
}
/** The Cloud hosted-store adapter — the OSS side of the hosted-store seam:
 * a plain StoreAdapter speaking RPC-over-HTTP to the console's /api/v1/store routes,
 * method for method. Tenant = the key's org, resolved server-side on every
 * call; reserved-collection semantics are enforced server-side by the same
 * engine rules as packages/store's routing. Secrets are excluded by
 * construction: the wire has no secrets surface, and storeSecrets/secretStore
 * keep requiring the local store handle. Cloned from cloudSandbox's shape:
 * behavior comes ONLY from constructor arguments (adapter rule — see
 * selectStore in compose-store.ts); the adapter never reads the environment. */
export declare function hostedStore(options: HostedStoreOptions): HostedStore;
/**
 * The Cloud client for the whole 50-op store contract, speaking
 * `vendo/store-wire@1` over the console's store mount: bearer key, deployment
 * identity and per-request abort budget shared with {@link hostedStore}, the
 * same adapter rule (behavior comes ONLY from the constructor arguments),
 * cursors passed through untouched (the server paginates, never the client),
 * and ONE Idempotency-Key per logical mutation, replayed verbatim on a retry.
 *
 * Every family speaks the EXPORTED contract: STORE_WIRE_PATHS routes with the
 * storeWire*RequestSchema bodies — collection/namespace/key ride the JSON body
 * and blob bytes are base64 on the wire — so any conforming Store Wire v1
 * service (the console's wire mount, a BYO httpStore) accepts them verbatim.
 * EVERY op takes its route from that table, erase included — its door really is
 * `/erase` rather than `/lifecycle/erase`, and the table says so, because a
 * client that spelled its own route was free to drift from the contract third
 * parties build against (it did, for as long as erase was hardcoded here).
 */
export declare function hostedStoreOps(options: HostedStoreOptions): StoreOps;
//# sourceMappingURL=hosted-store.d.ts.map