export { DASHBOARD_URL, getDashboardUrl } from './constants.js';
export declare function configDir(): string;
export declare function configFile(): string;
/** Install channel baked onto connect context; the connect flow is always CLI-driven. */
export declare const CONNECT_SOURCE = "tinyfish_cli";
export declare const CONNECT_ATTEMPT_ENV = "TINYFISH_CONNECT_ATTEMPT_ID";
export declare const RUNTIME_ATTEMPT_ENV = "TINYFISH_RUNTIME_ATTEMPT_ID";
/** Mirrors ConnectAuthMode; duplicated to keep auth.ts free of connect-runtime imports. */
export type RecordedAuthMode = 'api-key' | 'keyless' | 'oauth' | 'deferred';
interface ConnectEntry {
    attempt_id: string;
    auth_mode?: RecordedAuthMode;
    /** `connect cline --config-dir`: uninstall and doctor must find the same store. */
    config_dir?: string;
}
interface PendingConnectAttempt {
    id: string;
    ts: number;
}
interface TinyfishConfig {
    api_key?: string;
    connect?: Record<string, ConnectEntry>;
    pending_connect_attempt?: PendingConnectAttempt;
}
export declare function loadConfig(): TinyfishConfig;
export declare function isAttemptId(value: string): boolean;
/**
 * Park a page-minted attempt id for the connect that follows in a later process:
 * `auth login` and the connect it leads to are separate copied commands.
 */
export declare function savePendingConnectAttempt(attemptId: string): void;
/** Read-and-clear: one parked id seeds one install attempt, expired or not. */
export declare function takePendingConnectAttempt(): string | undefined;
/** Throwing variant for callers with their own cleanup (connect's telemetry flush). */
export declare function writeConfig(apiKey: string): void;
export declare function saveConfig(apiKey: string): void;
/** `authMode` omitted rewrites the entry without one: a reconnect that degraded must not keep a stale key claim. */
export declare function saveConnectContext(client: string, attemptId: string, authMode?: RecordedAuthMode): void;
/** Merged after connect wrote the entry; a missing entry means the install never landed. */
export declare function saveConnectConfigDir(client: string, configDir: string): void;
/** Distinguishes a missing entry from an unreadable config file. */
export declare function connectContextState(client: string): 'present' | 'absent' | 'unreadable';
/** Kept marker after uninstall makes doctor offer to reinstall the harness. */
export declare function clearConnectContext(client: string): void;
interface EnvironmentOptions {
    platform?: typeof process.platform;
    shell?: string;
}
export declare function persistApiKeyToEnvironment(apiKey: string, options?: EnvironmentOptions): void;
export declare function clearConfig(): boolean;
export declare function validateKeyFormat(key: string): boolean;
export declare function maskKey(key: string): string;
export type KeySource = 'explicit' | 'env' | 'config' | 'none';
export interface ResolvedKey {
    key: string;
    source: Exclude<KeySource, 'none'>;
}
export interface UnresolvedKey {
    error: string;
    source: KeySource;
}
/** Key for optional paths (telemetry, auth probes) — absent is a valid answer, so never exits. */
export declare function resolvedApiKey(explicitApiKey?: string): string | undefined;
/** Answers "is this the CLI's own key" without the value leaving the caller; see sdk/cli/CLAUDE.md. */
export declare function matchesCliKey(value: string | undefined): boolean;
/** resolvedApiKey for keys that reach a config file or the wire — loadConfig() is unvalidated on read. */
export declare function validatedApiKey(explicitApiKey?: string): string | undefined;
/**
 * The diagnosis, not the key: doctor must report a bad credential and say where it came from
 * rather than exit like getApiKey does.
 */
export declare function apiKeyStatus(explicitApiKey?: string): ResolvedKey | UnresolvedKey;
export declare function getApiKey(): string;