import type { ProviderConfig } from '../types/config.js';
import type { SecretVault } from '../types/secret-vault.js';
/**
 * A decrypted snapshot of the credential-bearing slice of `config.json`.
 * `providers` is always present (empty object when the file has none);
 * `apiKey`/`baseUrl` are the top-level fallbacks a provider inherits when its
 * saved entry omits them.
 */
export interface ProviderConfigSnapshot {
    providers: Record<string, ProviderConfig>;
    /** True when the config file actually had a `providers` key. The watcher
     *  callback uses this to avoid clearing in-memory providers during hot-reload
     *  when the profile config file simply doesn't define any — without this
     *  guard, reading a profile config that has no `providers` key would set
     *  `appConfig.providers = {}` and wipe all configured providers. */
    snapshotHasProviders: boolean;
    apiKey?: string;
    baseUrl?: string;
    /** Display language (Config.uiLocale), surfaced so a cross-process change
     *  (e.g. the desktop shell) propagates to running webui instances. */
    uiLocale?: string;
    /** Live routing fields — surfaced so a cross-process WebUI /setmodel or
     *  profile-reorder propagates to running workers without restart. */
    fallbackModels?: string[];
    fallbackProfiles?: Record<string, string[]>;
    favoriteModels?: string[];
    favoriteModelsOnly?: boolean;
    modelMatrix?: Record<string, unknown>;
    fallbackAuto?: boolean;
    modelAvailabilitySchedule?: import('../core/model-availability-calendar.js').ModelBlackoutRule[];
}
export interface WatchProviderConfigOptions {
    /** Surface non-fatal read/parse/decrypt issues. */
    warn?: (msg: string) => void;
    /** Coalesce bursts of fs events (default 200ms). */
    debounceMs?: number;
}
/**
 * Read and decrypt the credential slice of a config file. Returns `undefined`
 * when the file is missing or unparseable (the `warn` callback carries the
 * detail); never throws for routine I/O.
 *
 * Exported so multi-layer watchers (e.g. `provider-runtime-setup.ts`) can
 * re-read every active config layer when any layer changes, then merge them
 * with correct precedence before applying.
 */
export declare function readProviderSnapshot(configPath: string, vault: SecretVault, warn?: (msg: string) => void): Promise<ProviderConfigSnapshot | undefined>;
/**
 * Watch `configPath` for credential changes and invoke `onChange` with a
 * freshly-decrypted snapshot whenever the `providers`/`apiKey`/`baseUrl` slice
 * actually changes. Returns a `close()` that stops watching.
 *
 * The initial on-disk state is read once to seed the no-op guard but does NOT
 * fire `onChange` — only subsequent changes do.
 */
export declare function watchProviderConfig(configPath: string, vault: SecretVault, onChange: (snapshot: ProviderConfigSnapshot) => void, opts?: WatchProviderConfigOptions): {
    close: () => void;
};
//# sourceMappingURL=provider-config-watcher.d.ts.map