export * from "./client.js";
import type { KeychainTierOptions } from "../lib/client-types.js";
import { DomainsClient, type DomainsClientOptions } from "./client.js";
type ClientEnv = Record<string, string | undefined>;
/** Options accepted on top of the generated client options. */
export interface CreateDomainsClientOptions extends Partial<DomainsClientOptions> {
    /** Tier-1 identity selection (`--profile`), passed through to the seam. */
    profile?: string;
    /**
     * Tier-3 controls: a `security` runner for tests, or an opt-out on a CI Mac.
     * Production callers pass nothing — the tier is ambient for `process.env`
     * and off for a caller-built env.
     */
    keychain?: KeychainTierOptions;
}
/**
 * Build a `DomainsClient` whose credential and base URL come from the shared
 * @hasna/contracts resolver.
 *
 * Throws when no credential resolves from any tier — the SDK never falls back
 * to an unauthenticated client or to local data. An EXPLICIT `baseUrl`
 * argument with no explicit `apiKey` builds an unauthenticated client pinned
 * to that authority: the ambient fleet key is never attached (#1794).
 */
export declare function createDomainsClientFromEnv(env?: ClientEnv, overrides?: CreateDomainsClientOptions): DomainsClient;
//# sourceMappingURL=index.d.ts.map