export interface StoredConfig {
    key: string;
    key_hint: string;
    account_id: string;
    upgrade_url: string;
    /** Set by `vz login`: a vzm_ management token for key list/create/revoke/rotate and alerts. */
    mgmt_token?: string;
    /** Ms epoch. Past this, resolveMgmtToken() treats the token as absent; re-run `vz login`. */
    mgmt_token_expires_at?: number;
    /** The email confirmed by `vz login`. */
    email?: string;
}
/** Full path to the config file, e.g. ~/.veezee/config. */
export declare function configFilePath(): Promise<string>;
/** Reads the persisted config. Returns null when absent, unparsable, or in a non-Node runtime.
 * The file may hold only a subset of StoredConfig's fields (e.g. `vz login` ran before
 * `vz init`); callers check for the specific fields they need. */
export declare function readConfig(): Promise<StoredConfig | null>;
/** Writes the full config file (0600), creating the directory (0700) first if needed. Returns
 * true on success, false when persistence is impossible: no filesystem (non-Node runtimes) or a
 * write error (e.g. permission denied). Never throws. Overwrites whatever was there; prefer
 * updateConfig() unless you intend to replace the whole file. */
export declare function writeConfig(data: StoredConfig): Promise<boolean>;
/** Reads the existing config (or starts from {}), shallow-merges `partial` in, and writes the
 * result back. A key set to `undefined` in `partial` is dropped from the merged file (used by
 * `vz logout` to clear mgmt_token/mgmt_token_expires_at/email). This is how `vz login` avoids
 * clobbering a stored data key, and how `vz init`/client.mint() avoid clobbering a stored
 * management token. Same success/failure contract as writeConfig(). */
export declare function updateConfig(partial: Partial<StoredConfig>): Promise<boolean>;
/** Masks a raw key the way the mint endpoint's key_hint does, for keys that arrived via
 * VEEZEE_API_KEY (no stored hint to reuse). */
export declare function maskKey(key: string): string;
export interface ResolvedKey {
    key: string;
    source: "explicit" | "env" | "config";
    /** Only set when source is "config": the stored hint, so callers don't need to re-mask. */
    key_hint?: string;
}
/** Resolves an API key by precedence: explicit > VEEZEE_API_KEY env > ~/.veezee/config. The CLI
 * and client.mint() both call this so they never disagree about which key is active. */
export declare function resolveApiKey(explicit?: string): Promise<ResolvedKey | null>;
export interface ResolvedMgmtToken {
    token: string;
    source: "explicit" | "env" | "config";
}
/** Resolves a management token by precedence: explicit > VEEZEE_MGMT_TOKEN env >
 * ~/.veezee/config (from `vz login`). A config token past its mgmt_token_expires_at is treated
 * as absent (null), same as if `vz login` had never run; the caller tells the user to re-run it. */
export declare function resolveMgmtToken(explicit?: string): Promise<ResolvedMgmtToken | null>;