/**
 * `cleo llm` CLI engine operations (T9258 — T-LLM-CRED-CENTRALIZATION Phase 2).
 *
 * Thin engine-layer wrappers around the credentials-store, role-resolver and
 * config writer used by the `cleo llm` CLI surface and the matching dispatch
 * domain. Every function:
 *
 *   - takes a single typed `params` object (so `OpsFromCore` can infer the
 *     dispatch domain operation record),
 *   - returns a `Promise<EngineResult<T>>` for uniform wrapping by
 *     `wrapResult()`,
 *   - NEVER returns raw `accessToken` / `apiKey` values — only the last-4-char
 *     `tokenPreview` redaction surfaces in result envelopes.
 *
 * @module llm/cli-ops
 * @task T9258
 * @epic T-LLM-CRED-CENTRALIZATION
 */
import type { LlmAddParams, LlmAddResult, LlmAuxiliaryStatusParams, LlmAuxiliaryStatusResult, LlmListParams, LlmListResult, LlmProfileParams, LlmProfileResult, LlmRemoveParams, LlmRemoveResult, LlmSystemsOfUseParams, LlmSystemsOfUseResult, LlmTestParams, LlmTestResult, LlmUseParams, LlmUseResult, LlmWhoamiParams, LlmWhoamiResult } from '@cleocode/contracts';
import { type EngineResult } from '@cleocode/contracts';
import { resolveAuxiliaryFallbackChain } from './auxiliary-fallback.js';
/**
 * Redact every occurrence of a secret in free text (S-11).
 *
 * Used before DEBUG-logging a provider error body: Anthropic 4xx payloads can
 * reflect request headers (including the bearer token) back in human-readable
 * form, so the body must never reach a log stream with the live secret in it.
 * Replaces each occurrence with the standard last-4 preview. Empty/short
 * secrets (< 8 chars) redact nothing — they cannot meaningfully leak and a
 * short needle would shred unrelated text.
 *
 * @param text   - Raw text that may contain the secret.
 * @param secret - The live credential to scrub.
 * @returns The text with every occurrence of the secret replaced.
 * @task T11968
 */
export declare function redactSecret(text: string, secret: string | null): string;
/**
 * `llm.add` — upsert a credential into the multi-credential pool.
 *
 * @task T9258
 */
export declare function llmAdd(params: LlmAddParams): Promise<EngineResult<LlmAddResult>>;
/**
 * `llm.list` — list redacted credentials, optionally filtered by provider.
 *
 * @task T9258
 */
export declare function llmList(params: LlmListParams): Promise<EngineResult<LlmListResult>>;
/**
 * `llm.remove` — delete a `(provider, label)` pair from the pool.
 *
 * @task T9258
 */
export declare function llmRemove(params: LlmRemoveParams): Promise<EngineResult<LlmRemoveResult>>;
/**
 * `llm.use` — set `llm.default.{provider,model}` in the global config.
 *
 * When `params.model` is supplied, it is validated against the live catalog
 * (disk snapshot from `cleo llm refresh-catalog`). Unknown model IDs are
 * rejected with `E_MODEL_NOT_IN_CATALOG`. When the catalog snapshot is absent
 * the model is accepted with a soft warning so users are not blocked on a
 * fresh install before they have run `cleo llm refresh-catalog`.
 *
 * @task T9258
 * @task T11773
 */
export declare function llmUse(params: LlmUseParams): Promise<EngineResult<LlmUseResult>>;
/**
 * `llm.profile` — set `llm.roles[role]` in the global config.
 *
 * When `params.model` is supplied, it is validated against the live catalog
 * (disk snapshot from `cleo llm refresh-catalog`). Unknown model IDs are
 * rejected with `E_MODEL_NOT_IN_CATALOG`. When the catalog snapshot is absent
 * the model is accepted with a soft warning so users are not blocked on a
 * fresh install before they have run `cleo llm refresh-catalog`.
 *
 * @task T9258
 * @task T11773
 */
export declare function llmProfile(params: LlmProfileParams): Promise<EngineResult<LlmProfileResult>>;
/**
 * `llm.test` — round-trip ping against the resolved provider.
 *
 * Resolves a credential through the unified vault chokepoint (T11986 ·
 * DHQ-087): uses `resolveCredentialsAsync` (which delegates to the
 * {@link UnifiedCredentialPool}) so vault-stored credentials — including
 * OAuth tokens that may need refreshing — are always visible to diagnostic
 * probes. The legacy sync `resolveCredentials()` path was replaced here
 * because it skips the pool's lazy-seed and refresh-on-use steps.
 *
 * When a specific `label` is supplied, the credential is looked up directly
 * from the store (bypassing the pool picker). This path also benefits from
 * refresh-on-use: if the stored credential is an expired OAuth token with a
 * refresh token, `resolveCredentialsAsync` will renew it through the pool
 * before returning.
 *
 * NEVER returns the raw token in the result envelope (S-11).
 *
 * @task T9258
 * @task T11986
 */
export declare function llmTest(params: LlmTestParams): Promise<EngineResult<LlmTestResult>>;
/**
 * `llm.whoami` — resolve every role (or a single `params.role`) and report
 * how each one would be wired today.
 *
 * @task T9258
 */
export declare function llmWhoami(params: LlmWhoamiParams): Promise<EngineResult<LlmWhoamiResult>>;
/**
 * `llm.systems-of-use` — enumerate every system-of-use for the TUI / Studio
 * profile picker (T11751 · AC2).
 *
 * Returns the merged surface: the static {@link BUILTIN_SYSTEMS_OF_USE} table
 * plus every runtime-registered system (`registerSystemOfUse`). This is the ONE
 * enumeration op the picker reads — it never re-derives the system list itself,
 * so a newly-registered system appears in the picker without a UI edit.
 *
 * @task T11751
 * @epic T11745
 */
export declare function llmSystemsOfUse(params: LlmSystemsOfUseParams): Promise<EngineResult<LlmSystemsOfUseResult>>;
/**
 * `llm.auxiliary-status` — report the active auxiliary fallback chain
 * and how to configure it.
 *
 * The chain determines which providers are tried (in order) when an auxiliary
 * LLM call fails due to pool exhaustion. Configured via:
 *
 * ```
 * cleo config set llm.auxiliaryFallback "anthropic,openrouter,groq"
 * ```
 *
 * Returns the resolved chain plus the config key and an example value so
 * users can copy-paste to customise.
 *
 * @task T9319
 */
export declare function llmAuxiliaryStatus(params: LlmAuxiliaryStatusParams): Promise<EngineResult<LlmAuxiliaryStatusResult>>;
export { resolveAuxiliaryFallbackChain };
//# sourceMappingURL=cli-ops.d.ts.map