import { type ManagedApiKeyBindResponse } from '../../lib/api.js';
import { type ManagedKeyStatus } from './types.js';
/**
 * Set callback for when the API key changes.
 * This allows other parts of the system (e.g., WebSocket) to be notified.
 */
export declare function onKeyChanged(callback: (newKey: string) => void): void;
/**
 * Called when WebSocket reconnects after a disconnect.
 * Immediately polls to detect any rotations that may have been missed.
 */
export declare function onWebSocketReconnect(): Promise<void>;
/**
 * Called when WebSocket authentication fails (401 Unauthorized).
 * This is a critical safety rail - if the agent's stored key is stale/expired,
 * we need to perform a fresh bind to get the current key BEFORE reconnecting.
 *
 * Returns true if key was refreshed successfully (caller should reconnect).
 * Returns false if refresh failed (key is truly invalid, needs manual intervention).
 */
export declare function onWebSocketAuthFailure(): Promise<boolean>;
/**
 * Called when a WebSocket rotation event is received.
 * Marks that we received the WS event and triggers a refresh.
 */
export declare function onWebSocketRotationEvent(keyName: string): Promise<void>;
/**
 * Start the managed key renewal service.
 * Returns the initial bind response or null if not in managed key mode.
 */
export declare function startManagedKeyRenewal(): Promise<ManagedApiKeyBindResponse | null>;
/**
 * Stop the managed key renewal service.
 */
export declare function stopManagedKeyRenewal(): void;
/**
 * Force an immediate key refresh.
 */
export declare function forceRefresh(): Promise<ManagedApiKeyBindResponse | null>;
/**
 * Get current managed key status with safety rail tracking info.
 */
export declare function getManagedKeyStatus(): ManagedKeyStatus;
//# sourceMappingURL=service.d.ts.map