export declare const KEY_RESOLUTION_SCHEMA = "humanish.key-resolution.v1";
/** The ONLY names implicit discovery may fill (and `humanish keys set` may store). Everything
 *  else in an overlay/store file is ignored-and-named: a repo-planted NODE_OPTIONS/LD_PRELOAD
 *  must never enter process env off a file the operator did not explicitly pass (an explicit
 *  --env-file remains the operator's own full-file load). Red-team finding, #436. */
export declare const KNOWN_PROVIDER_KEYS: readonly ["OPENAI_API_KEY", "ANTHROPIC_API_KEY", "E2B_API_KEY", "GH_TOKEN", "GITHUB_TOKEN", "CODEX_API_KEY", "AGENTMAIL_API_KEY"];
/** `humanish keys set <vendor>` aliases; a raw ENV_NAME is also accepted. */
export declare const KEY_VENDOR_ALIASES: Record<string, string>;
export interface ResolvedKeyFill {
    name: string;
    /** Human-readable source label (a path or command name) — never a value. */
    source: string;
}
export interface KeyResolutionDeps {
    /** Injectable for tests: run `gh auth token`-style probes. Resolves to trimmed single-line
     *  stdout, or null on any failure (missing binary, non-zero exit, empty/multi-line output). */
    execText?: (command: string, args: string[], timeoutMs: number) => Promise<string | null>;
    homeDir?: string;
}
export declare const PROJECT_OVERLAY_RELATIVE: string;
export declare function userKeyStorePath(env: NodeJS.ProcessEnv, deps?: KeyResolutionDeps): string;
/**
 * Fill missing provider keys into `env` from the discovery chain, announcing each fill as
 * `NAME from SOURCE`. Returns the fills. Opt-out: HUMANISH_STRICT_KEYS=1 returns [] untouched.
 */
export declare function discoverProviderKeys(args: {
    cwd: string;
    env: NodeJS.ProcessEnv;
    announce: (line: string) => void;
    deps?: KeyResolutionDeps;
}): Promise<ResolvedKeyFill[]>;
export interface KeySourceProbe {
    name: string;
    /** The source that supplies the key right now, or null when missing everywhere. */
    source: string | null;
    /** The command/path that would fill it when missing. */
    hint: string;
}
/** The nearest fill instruction for a missing key — used by doctor rows and appended to
 *  *_KEYS_MISSING errors so the failure names the fix, not just the absence (#436). */
export declare function missingKeyHint(name: string): string;
/** One shared suffix for *_KEYS_MISSING messages: where discovery looked, and what fills each
 *  missing key. Pure text; never values. */
export declare function describeMissingKeys(names: string[], env: NodeJS.ProcessEnv): string;
/**
 * Non-mutating probe for doctor: report, per key, the source that currently supplies it.
 * Runs the same chain against a scratch copy of env so nothing observable changes.
 */
export declare function probeKeySources(names: readonly string[], args: {
    cwd: string;
    env: NodeJS.ProcessEnv;
    deps?: KeyResolutionDeps;
}): Promise<KeySourceProbe[]>;
/** Resolve a `humanish keys set` target: a vendor alias or a raw env name. Null = invalid. */
export declare function resolveKeyName(vendorOrName: string): string | null;
/** Write one key into the user store (0700 dir, 0600 file). Only allowlisted provider names
 *  are storable (the store feeds implicit discovery — an arbitrary-name store would be an env
 *  injection vector with extra steps). The value must be a single non-empty line that
 *  round-trips the store's own parser byte-identically, and the write refuses symlinks at the
 *  file AND its parent directory (red-team findings). */
export declare function setUserKey(name: string, value: string, env: NodeJS.ProcessEnv, deps?: KeyResolutionDeps): {
    path: string;
};
/** Remove one key from the user store. Returns whether it was present. */
export declare function unsetUserKey(name: string, env: NodeJS.ProcessEnv, deps?: KeyResolutionDeps): boolean;
/** The names (never values) currently in the user store. */
export declare function listUserKeys(env: NodeJS.ProcessEnv, deps?: KeyResolutionDeps): string[];