export declare const LLM_SECRETS_PATH: string;
interface SecretsFile {
    version: number;
    keys: Record<string, string>;
}
/** Convert a backend name to the env var suffix. Same rule as the rest
 *  of the codebase: non-alphanumeric → underscore, uppercased. So
 *  "deepseek-cheap" → "AGIM_LLM_SECRET_DEEPSEEK_CHEAP". */
export declare function envKeyForBackend(name: string): string;
/** Vendor hint passed by the registry so we can fall back to standard
 *  vendor envs (`DEEPSEEK_API_KEY`, `OPENAI_API_KEY`, …). Optional —
 *  callers from CLI tests etc. can omit it and only see Agim-managed
 *  lookup paths. */
export interface BackendHint {
    provider?: string;
    baseUrl?: string;
}
/** Diagnostic — returns the list of vendor env names that would be
 *  probed for a given backend hint. Used by `describeSecretSource` to
 *  show the operator which envs are checked when both private slots
 *  are empty. */
export declare function vendorEnvCandidates(hint: BackendHint | undefined): string[];
/**
 * Read the on-disk secrets file (or return an empty SecretsFile if missing / corrupt).
 * Logs a warning on corrupt files so operators notice — we deliberately
 * don't throw because callers want the provider to gracefully report
 * "not configured" rather than crash agim at startup.
 */
export declare function loadSecretsFile(): SecretsFile;
/**
 * Resolve a single secret for a backend, applying env-var precedence.
 * Returns undefined when nothing is configured — providers downstream
 * use this to flip `isConfigured()` off.
 *
 * v1.2.141 — `backendHint` enables vendor-env fallback. Callers that
 * have backend config in hand (registry.ts) should pass it so users
 * who exported `DEEPSEEK_API_KEY` / `OPENAI_API_KEY` / etc. via vendor
 * convention don't also need to copy the value into our private
 * `AGIM_LLM_SECRET_*` namespace.
 */
export declare function resolveSecret(backendName: string, fileSecrets?: SecretsFile, backendHint?: BackendHint): string | undefined;
/**
 * Persist a secret. Idempotent — writes the entire file with 0600
 * perms. Used by the CLI wizard (`agim config llm add`) once we land
 * Stage 4; Stage 1 ships the helper so tests can exercise it.
 */
export declare function saveSecret(backendName: string, apiKey: string): void;
/** Remove a secret entirely. Safe to call on missing names. */
export declare function removeSecret(backendName: string): void;
/** Test helper: list configured backend names (no values). */
export declare function listConfiguredBackends(): string[];
/**
 * One-shot health check used by the CLI wizard + web "test backend"
 * button. Returns a short reason string when something looks off so the
 * UI doesn't have to guess. The string is operator-facing; keep it
 * succinct and actionable.
 */
export declare function describeSecretSource(backendName: string, backendHint?: BackendHint): {
    source: 'env' | 'file' | 'vendor' | 'none';
    envKey: string;
    filePath: string;
    /** v1.2.141 — when source==='vendor', this is the vendor env var
     *  name that actually held the secret (e.g. 'DEEPSEEK_API_KEY'). */
    vendorEnvName?: string;
    /** v1.2.141 — when source==='none' but a backendHint was supplied,
     *  the candidate vendor envs we tried (helps operators figure out
     *  which standard env to set). */
    vendorCandidates?: string[];
    perms?: string;
};
export {};
//# sourceMappingURL=secrets.d.ts.map