import type { ProviderId, ProviderStatus } from '../types.js';
import { maskSecret } from '../llm/provider.js';
import type { SearchProviderId } from '../tools/web/types.js';
import { getSecret, setSecret, unsetSecret } from "./keys/secret-store.js";
import { MAX_PROVIDER_KEYS, ProviderKeysResult, parseProviderKeysPayload, serializeProviderKeysPayload } from "./keys/search-providers.js";
export { appendSearchProviderKey, getSearchProviderKey, getSearchProviderKeys, markSearchProviderKeySuccess, setSearchProviderKeyDisabled, setSearchProviderKeys, unsetSearchProviderSecret } from "./keys/search-providers.js";
export { parseProviderKeysPayload, serializeProviderKeysPayload };
export type { ProviderKeySlot, ProviderKeysResult } from "./keys/search-providers.js";
export { secretAccount } from "./keys/secret-store.js";
export { getSecret, setSecret, unsetSecret };
export type { SecretNamespace, SecretSource } from "./keys/secret-store.js";
export declare function getFallbackKeysPath(): string;
export declare function searchProviderEnvVar(id: SearchProviderId): string | undefined;
export declare function envValue(provider: ProviderId): string | undefined;
/**
 * Resolve all API keys for a provider.
 *
 * Precedence:
 *   1. Stored multi/single key under `llm:<provider>` (keychain / fallback)
 *   2. Env var as a single synthetic slot when nothing is stored
 *
 * `ollama` returns the host URL as a single local "key" for listing only.
 */
export declare function getProviderKeys(provider: ProviderId): Promise<ProviderKeysResult>;
/**
 * Resolve an LLM provider's secret using the precedence:
 *
 *   1. OS keychain account `llm:<provider>` (with lazy migration of the
 *      legacy bare `<provider>` account) — i.e. a key the user explicitly
 *      stored via `clai set <provider> <key>` always wins.
 *   2. Restricted-permission plaintext fallback file (`~/.clai/keys.json`)
 *   3. Provider env var (e.g. `OPENAI_API_KEY`) — used only when nothing has
 *      been explicitly stored, so a stale ambient export can never override
 *      a key the user deliberately set with `clai set`.
 *
 * Returns the **active** (sticky) key when multiple are configured.
 *
 * `ollama` is special-cased: it has no API key, only a base URL drawn from
 * `OLLAMA_HOST` or the user-config `ollamaHost`.
 */
export declare function getProviderSecret(provider: ProviderId): Promise<{
    value?: string;
    source: ProviderStatus['source'];
}>;
export declare function setProviderKeys(provider: ProviderId, values: readonly string[], activeIndex?: number, disabledValues?: readonly string[]): Promise<'keychain' | 'fallback'>;
export declare function appendProviderKey(provider: ProviderId, secret: string): Promise<'keychain' | 'fallback'>;
export declare function setProviderSecret(provider: ProviderId, secret: string): Promise<'keychain' | 'fallback'>;
export declare function unsetProviderSecret(provider: ProviderId): Promise<void>;
export declare function markProviderKeySuccess(provider: ProviderId, index: number): Promise<void>;
export declare function setProviderKeyDisabled(provider: ProviderId, value: string, disabled: boolean): Promise<boolean>;
export { MAX_PROVIDER_KEYS };
export type KeychainStatus = {
    available: true;
} | {
    available: false;
    reason: 'module-missing' | 'runtime-error';
    detail?: string;
};
/**
 * Probes the OS keychain by performing a harmless read against a marker
 * service. Used by `clai doctor` so users can tell at a glance whether
 * secrets land in the OS store or the restricted-permission plaintext
 * fallback file at ~/.clai/keys.json.
 */
export declare function probeKeychain(): Promise<KeychainStatus>;
export declare function listProviderStatuses(activeProvider: ProviderId): Promise<ProviderStatus[]>;
export { maskSecret };