import type { Config } from '../config/schema.js';
import type { OAuthCredentials } from './oauth/types.js';
export type CredentialType = 'api_key' | 'oauth';
export interface ApiKeyProfile {
    type: 'api_key';
    provider: string;
    profileName?: string;
    envVar?: string | null;
    key: string | null;
}
export interface OAuthToken {
    type: 'oauth';
    provider: string;
    access: string;
    refresh?: string;
    expiresAt?: number;
    scope?: string[];
    createdAt: string;
    updatedAt: string;
}
type OAuthTokenInput = Omit<OAuthToken, 'type' | 'provider' | 'updatedAt'> & Record<string, unknown>;
export type CredentialProfile = ApiKeyProfile;
export interface AuthProfilesFile {
    version: number;
    profiles: Record<string, ApiKeyProfile>;
}
export interface CredentialResolverOptions {
    stateDir?: string;
    /** When set, per-agent auth profiles are read from `resolveAgentAuthProfilesPath(appConfig, agentId)`. */
    agentId?: string;
    /** Required when `agentId` is set. */
    appConfig?: Config;
}
export declare class CredentialResolver {
    private readonly credentialsDir;
    private readonly agentId?;
    private readonly appConfig?;
    constructor(options?: CredentialResolverOptions);
    /**
     * Resolve API key for a provider
     * Priority: Agent private > Global > OAuth > Environment
     */
    resolveApiKey(provider: string): Promise<string | null>;
    /**
     * Check if a provider has credentials configured
     */
    hasCredentials(provider: string): Promise<boolean>;
    /**
     * Which step in {@link resolveApiKey} would supply the key (no secret material).
     */
    resolveApiKeySource(provider: string): Promise<'agent' | 'global' | 'oauth' | 'env' | null>;
    /**
     * List all available credential profiles
     */
    listProfiles(): Promise<Array<ApiKeyProfile & {
        id: string;
        source: 'agent' | 'global';
    }>>;
    /**
     * Plaintext API key from global auth profiles only (no env/oauth fallback).
     * Used by the gateway console reveal endpoint.
     */
    revealGatewayStoredApiKey(provider: string): Promise<string | null>;
    /**
     * Save an API key profile
     */
    saveApiKey(provider: string, key: string, options?: {
        profileName?: string;
        envVar?: string | null;
        agentPrivate?: boolean;
    }): Promise<void>;
    /**
     * Delete a credential profile
     */
    deleteProfile(profileId: string, options?: {
        agentPrivate?: boolean;
    }): Promise<void>;
    /**
     * Load OAuth token for a provider.
     */
    loadOAuthToken(provider: string): Promise<OAuthToken | null>;
    private hasUsableOAuthTokenRecord;
    /**
     * Load the raw OAuth token record, including expired tokens for status UIs.
     */
    loadOAuthTokenRecord(provider: string): Promise<OAuthToken | null>;
    /**
     * List persisted OAuth tokens without exposing access/refresh values.
     */
    listOAuthTokens(): Promise<Array<Omit<OAuthToken, 'access' | 'refresh'> & {
        hasAccess: boolean;
        hasRefresh: boolean;
    }>>;
    /**
     * Save raw provider OAuth credentials without converting them to an API key representation.
     */
    saveOAuthCredentials(provider: string, credentials: OAuthCredentials): Promise<void>;
    /**
     * Save OAuth token for a provider.
     */
    saveOAuthToken(provider: string, token: OAuthTokenInput): Promise<void>;
    /**
     * Delete the OAuth token persisted for a provider.
     */
    deleteOAuthToken(provider: string): Promise<void>;
    /**
     * Disconnect the default credential for a provider from local storage.
     */
    deleteProviderCredential(provider: string): Promise<void>;
    private loadFromAgentCredentials;
    private loadFromGlobalCredentials;
    private loadFromEnv;
    private findProfileForProvider;
    private loadAuthProfilesFile;
    private loadAgentAuthProfilesFile;
    private saveGlobalAuthProfile;
    private saveAgentAuthProfile;
    private deleteGlobalAuthProfile;
    private deleteAgentAuthProfile;
}
export declare function getCredentialResolver(options?: CredentialResolverOptions): CredentialResolver;
export declare function resolveApiKey(provider: string, options?: CredentialResolverOptions): Promise<string | null>;
export declare function hasCredentials(provider: string, options?: CredentialResolverOptions): Promise<boolean>;
export {};