export interface ShareConfig {
    /** Public base, e.g. `https://share.getrush.ai` or `https://agent-share.<acct>.workers.dev`. */
    baseUrl: string;
    accountId: string;
    workerName: string;
    bucketName: string;
    /** Custom domain when mapped (e.g. `share.getrush.ai`). */
    domain?: string;
    /** Cloudflare Web Analytics token injected into published HTML pages. */
    analyticsToken?: string;
    /** sha256 of the Worker script deployed at the last provision/update. Absent
     * on any config written before this field existed — treat that as "unknown",
     * never as "outdated" (there is nothing to compare against). */
    templateHash?: string;
}
export declare const SHARE_BUNDLE = "share";
export declare const SHARE_TOKEN_KEY = "WRITE_TOKEN";
export declare const SHARE_TOKEN_ENV_KEY = "SHARE_WRITE_TOKEN";
export declare const DEFAULT_CF_BUNDLE = "cloudflare";
export declare const DEFAULT_WORKER_NAME = "agents-share";
export declare const DEFAULT_BUCKET_NAME = "agents-share";
export declare const DEFAULT_SHARE_DOMAIN = "share.getrush.ai";
export declare const LEGACY_MANAGED_SHARE_DOMAINS: readonly ["share.agents-cli.sh", "artifacts.prix.dev"];
/** The write token may be injected ephemerally into fleet/cloud agents. */
export declare function readWriteTokenEnv(env?: NodeJS.ProcessEnv): string | null;
/**
 * Read the persisted endpoint config, or null if there is no `share.baseUrl`.
 *
 * Publish talks only to `baseUrl` with `WRITE_TOKEN`. `accountId` / worker /
 * bucket are provisioning metadata for `setup`/`update`. Requiring all four
 * (and treating `accountId: ""` as missing) made `status` and publish both
 * report "not set up" on an endpoint that still worked — RUSH-2837.
 */
export declare function readShareConfig(): ShareConfig | null;
/** Persist the endpoint config to `agents.yaml` (syncs across the fleet).
 * Empty strings never overwrite a previously stored value and are not written
 * back as `accountId: ""` (that form made {@link readShareConfig} return null
 * under the old all-fields-required check, and it is still useless). */
export declare function writeShareConfig(cfg: ShareConfig): void;
/** A fresh 32-byte hex write token. */
export declare function generateWriteToken(): string;
/** Persist the raw write token into the `share` secrets bundle (keychain-backed,
 * fleet-injectable). Mirrors the add-key sequence in `commands/secrets.ts`. */
export declare function storeWriteToken(token: string): void;
/** Read the raw write token from the `share` secrets bundle. */
export declare function readWriteTokenFromBundle(): string;
/** Read the raw write token from injected env first, then the local bundle.
 * Throws with an actionable message if absent (run setup/join first). */
export declare function readWriteToken(): string;
/** Best-effort runtime env for spawned agents. Never throws AND never prompts.
 *
 * Auto-injecting the share write token on every `agents run` is a background
 * convenience, NOT a user-initiated secret access — so it MUST NOT raise a Touch
 * ID sheet (SEC-13: an agent launch never pops biometry on its own). This was the
 * per-run prompt storm: `share` is a keychain bundle that is rarely broker-held,
 * so an interactive read here spawned the helper and popped Touch ID on EVERY
 * launch. The read is now always `agentOnly` — it resolves the token only from the
 * injected env or an already-held / no-ACL bundle, and silently returns undefined
 * otherwise (the caller runs without auto-share; the agent can still publish via
 * its own `agents artifacts share`). To get zero-friction auto-share with no prompt: unlock
 * once (`agents secrets unlock share`) or make it no-ACL (`agents secrets policy
 * share never`). */
export declare function shareRuntimeEnv(): Record<string, string> | undefined;
/** Cloudflare API credentials for provisioning, read from `cloudflare` (or a
 * user-named bundle). Fuzzy-matches key names so it works across bundle layouts. */
export declare function readCloudflareCreds(bundle?: string, override?: {
    apiToken?: string;
    accountId?: string;
}): {
    apiToken: string;
    accountId: string;
};
