/**
 * Client-side key kind detection + guards.
 *
 * The v1.2 server enforces the same prefix split; these guards are the
 * first line of defense so that a developer who copies a secret-kind key
 * into a browser context gets a loud error BEFORE any network call is made.
 */
export type KeyKind = 'public' | 'secret' | 'legacy' | 'invalid' | 'missing';
export declare function detectKeyKind(key: string | undefined): KeyKind;
export interface AssertOptions {
    /** True when NODE_ENV !== 'production'. Dev builds throw; prod logs + no-ops. */
    envIsDev: boolean;
}
export interface AssertResult {
    ok: boolean;
    kind: KeyKind;
    reason?: 'secret-key-in-browser' | 'malformed-key';
}
/**
 * Check that a key is safe to use in a browser context.
 *
 * - secret kind: DEV throws, PROD logs + returns {ok: false}
 * - malformed:   DEV throws, PROD logs + returns {ok: false}
 * - public / legacy / missing: ok
 */
export declare function assertClientSafeKey(key: string | undefined, opts: AssertOptions): AssertResult;
/** True when NODE_ENV is not 'production'. Safe for edge/worker runtimes. */
export declare function envIsDev(): boolean;
//# sourceMappingURL=key-guards.d.ts.map