import { type SecretsProvider } from "./core/index.js";
/** The Cloud secrets provider — the implementation the composition seam
 * (selectSecrets in server.ts) chains BEHIND envSecrets when VENDO_API_KEY
 * fills the unset slot (adapter rule — see selectConnections in server.ts;
 * the provider itself never reads the environment). Rides the shared
 * console-client plumbing (cloud-console.ts): Bearer auth + deployment
 * identity + per-request abort timeout + the honest 401/402 → cloud-required
 * error table.
 *
 * Wire contract (the console endpoint is built in a sibling lane; the
 * fixtures in cloud-secrets.test.ts ARE the contract until it lands):
 *
 *   GET <console>/api/v1/secrets/<encodeURIComponent(name)>
 *     authorization: Bearer <key>   accept: application/json
 *     x-vendo-deployment-* identity headers (deployment-identity.ts)
 *
 *   200 { "value": "<string>" } → resolves the value
 *   404 (any body)              → resolves undefined — a missing secret is
 *                                 the SecretsProvider contract's "unset"
 *                                 (01-core §13), never an error
 *   401/402                     → VendoError("cloud-required") with the
 *                                 server's message (shared console table)
 *   anything else               → wire-legal envelope codes forward as
 *                                 VendoErrors; unknown codes, 5xx, and
 *                                 non-JSON bodies ride a plain Error — the
 *                                 SERVICE misbehaving, never the caller's
 *                                 fault (hosted-store's posture). */
export interface CloudSecretsOptions {
    apiKey: string;
    /** Defaults to the Vendo console; the composition seam passes VENDO_CONSOLE_URL. */
    baseUrl?: string;
    fetch?: typeof fetch;
    /** Per-request abort budget (default 30s, hosted-store's). */
    timeoutMs?: number;
}
export declare function cloudSecrets(options: CloudSecretsOptions): SecretsProvider;
/** First-hit-wins provider chaining for the secrets seam (selectSecrets in
 * server.ts): a defined, NON-EMPTY value from an earlier provider wins — so
 * process env stays authoritative over Cloud for any name the operator ships
 * locally (the hard BYO rule) — and a provider failure PROPAGATES rather than
 * being swallowed: redaction already tolerates provider failures at its own
 * layer, and masking a broken Cloud standing here would read as "secret
 * unset" forever. */
export declare function chainSecrets(...providers: SecretsProvider[]): SecretsProvider;