export declare const LLM_SECRETS_PATH: string;
interface SecretsFile {
    version: number;
    keys: Record<string, string>;
}
/** Convert a backend name to the env var suffix. Same rule as the rest
 *  of the codebase: non-alphanumeric → underscore, uppercased. So
 *  "deepseek-cheap" → "AGIM_LLM_SECRET_DEEPSEEK_CHEAP". */
export declare function envKeyForBackend(name: string): string;
/** Vendor hint passed by the registry so we can fall back to standard
 *  vendor envs (`DEEPSEEK_API_KEY`, `OPENAI_API_KEY`, …). Optional —
 *  callers from CLI tests etc. can omit it and only see Agim-managed
 *  lookup paths. */
export interface BackendHint {
    provider?: string;
    baseUrl?: string;
    /** Preset / vendor id (`deepseek`, `moonshot`). One key covers every model. */
    label?: string;
    /** Other backend names that share this vendor (legacy per-model file keys). */
    siblingNames?: string[];
}
export interface SecretBackendRef {
    name: string;
    provider?: string;
    baseUrl?: string;
    label?: string;
}
/** Diagnostic — returns the list of vendor env names that would be
 *  probed for a given backend hint. Used by `describeSecretSource` to
 *  show the operator which envs are checked when both private slots
 *  are empty. */
export declare function vendorEnvCandidates(hint: BackendHint | undefined): string[];
/**
 * Read the on-disk secrets file (or return an empty SecretsFile if missing / corrupt).
 * Logs a warning on corrupt files so operators notice — we deliberately
 * don't throw because callers want the provider to gracefully report
 * "not configured" rather than crash agim at startup.
 */
export declare function loadSecretsFile(): SecretsFile;
export declare function sameVendorGroup(a: SecretBackendRef, b: SecretBackendRef): boolean;
/** File / env slot for a builtin vendor. Custom backends keep a per-name slot. */
export declare function secretSlotForBackend(backendName: string, hint?: BackendHint): string;
export declare function secretHintForBackend(backend: SecretBackendRef, all?: SecretBackendRef[]): BackendHint;
/**
 * Resolve a single secret for a backend, applying env-var precedence.
 * Returns undefined when nothing is configured — providers downstream
 * use this to flip `isConfigured()` off.
 *
 * Pass a `backendHint` (label / baseUrl / siblings) so builtin vendors
 * share one file slot and legacy per-model keys still resolve.
 */
export declare function resolveSecret(backendName: string, fileSecrets?: SecretsFile, backendHint?: BackendHint): string | undefined;
/**
 * Persist a secret. Idempotent — writes the entire file with 0600
 * perms. Used by the CLI wizard (`agim config llm add`) once we land
 * Stage 4; Stage 1 ships the helper so tests can exercise it.
 */
export declare function saveSecret(backendName: string, apiKey: string): void;
/** Persist a key on the vendor slot for builtin presets (`keys.deepseek`). */
export declare function saveSecretForBackend(backendName: string, apiKey: string, hint?: BackendHint): void;
/** Clear the vendor slot (and leftover per-name key) for one backend. */
export declare function clearSecretForBackend(backendName: string, hint?: BackendHint): void;
/** Drop per-name leftovers; drop the vendor slot only when no sibling remains. */
export declare function removeSecretsForRemovedBackends(removed: SecretBackendRef[], remaining: SecretBackendRef[]): void;
/** Remove a secret entirely. Safe to call on missing names. */
export declare function removeSecret(backendName: string): void;
/** Test helper: list configured backend names (no values). */
export declare function listConfiguredBackends(): string[];
/**
 * One-shot health check used by the CLI wizard + web "test backend"
 * button. Returns a short reason string when something looks off so the
 * UI doesn't have to guess. The string is operator-facing; keep it
 * succinct and actionable.
 */
export declare function describeSecretSource(backendName: string, backendHint?: BackendHint): {
    source: 'env' | 'file' | 'vendor' | 'none';
    envKey: string;
    filePath: string;
    /** v1.2.141 — when source==='vendor', this is the vendor env var
     *  name that actually held the secret (e.g. 'DEEPSEEK_API_KEY'). */
    vendorEnvName?: string;
    /** v1.2.141 — when source==='none' but a backendHint was supplied,
     *  the candidate vendor envs we tried (helps operators figure out
     *  which standard env to set). */
    vendorCandidates?: string[];
    perms?: string;
};
export {};
//# sourceMappingURL=secrets.d.ts.map