/**
 * Webhook subscription persistence helpers for CLI.3.
 *
 * Split out of `webhooks.ts` (file-size budget). Three concerns:
 *
 *   1. `readWebhooksFile` / `writeWebhooksFile` — load + atomically rewrite
 *      `~/.opensquid/webhooks.yaml`. Schema mirrors the SCHED.1 runtime
 *      loader (`src/runtime/webhook_subscriptions.ts`) so anything the CLI
 *      writes is consumable by the daemon without a second migration step.
 *      Atomic write via `tmp + rename` (now delegated to `state_io.ts`).
 *   2. `genSecret` — `crypto.randomBytes(32).toString('hex')` returning the
 *      64-char lowercase hex string used for HMAC-SHA256 signing keys. The
 *      caller embeds it via a `literal:<hex>` URI so the runtime's secret
 *      resolver (post-`literalBackend()` registration) reads it back.
 *   3. `defaultWebhooksPath` / `defaultWebhookPort` — `~/.opensquid/
 *      webhooks.yaml` + `8765` matching `DEFAULT_WEBHOOK_PORT` in
 *      `src/runtime/daemon.ts`.
 *
 * Secret-handling discipline (audit-critical):
 *
 *   We DO NOT use the runtime `SecretResolver` here. The CLI is the
 *   authoritative writer of inline-literal subscriptions; introducing
 *   resolver indirection in the CLI write path would couple the CLI to
 *   the resolver's env-var / 1Password backends and break the locked
 *   "write new secret to webhooks.yaml BEFORE invalidating old" atomic
 *   rotation contract. The `secret:` field is stored as the URI
 *   `literal:<64-hex>` directly — readers (CLI + daemon) get the hex by
 *   either stripping the `literal:` prefix (CLI) or routing through the
 *   resolver with `literalBackend()` registered (daemon, configured at
 *   setup time outside this task's scope).
 *
 * Imports from: node:crypto, ../../runtime/paths, ./state_io.
 * Imported by: src/setup/cli/webhooks.ts + src/setup/cli/webhooks_actions.ts.
 */
/** CLI-managed shape mirrors the SCHED.1 `SubscriptionYaml` exactly. */
export interface SubscriptionRecord {
    id: string;
    pack: string;
    /** Required unless deliver_only is true. */
    skill?: string;
    /** URI for the SecretResolver. CLI writes `literal:<64-hex>`. */
    secret: string;
    /** SCHED.2 zero-LLM mode flag. Default false on disk; we never write
     *  `deliver_only: false` explicitly to keep skill-mode YAML clean. */
    deliver_only?: boolean;
    template?: string;
    deliver_to?: string;
    severity?: 'critical' | 'error' | 'warning' | 'info';
    rate_limit?: {
        max: number;
        per: 'minute' | 'hour' | 'day';
    };
    /** ISO-8601 timestamps the CLI stamps for audit. Daemon ignores. */
    created_at?: string;
    rotated_at?: string;
}
export declare const defaultWebhooksPath: () => string;
/** Mirrors `DEFAULT_WEBHOOK_PORT` in `src/runtime/daemon.ts`. */
export declare const defaultWebhookPort: () => number;
/** Generate a 64-char lowercase hex HMAC-SHA256 signing key (32 bytes). */
export declare function genSecret(): string;
/** Compose the `literal:` URI the CLI persists into `secret:`. */
export declare function literalSecretUri(hex: string): string;
/** Strip a `literal:` prefix; returns the URI unchanged if not literal. */
export declare function unwrapLiteralSecret(uri: string): {
    literal: boolean;
    value: string;
};
/** Canonical `http://localhost:<port>/webhook/<id>` URL — daemon route. */
export declare function webhookUrl(id: string, port: number): string;
export declare function readWebhooksFile(path: string): Promise<SubscriptionRecord[]>;
/**
 * Atomic write — delegates to `writeKeyedYamlList` (T-SIC L9 byte-preserves
 * the `subscriptions: []\n` empty form). Callers MUST pass the FULL
 * desired subscription set; we never merge here because partial writes
 * risk dropping unrelated subscriptions on concurrent CLI invocations.
 */
export declare function writeWebhooksFile(path: string, subscriptions: readonly SubscriptionRecord[]): Promise<void>;
//# sourceMappingURL=webhooks_state.d.ts.map