import type { Config } from "./config.js";
import { type KeystoreOptions } from "./keystore.js";
import { type KeyCheckResult } from "./key-checker.js";
export type KeysSecretPurpose = "credential" | "keystore-passphrase" | "export-passphrase" | "import-passphrase" | "unlock-passphrase";
export type KeysSecretReader = (prompt: string, purpose: KeysSecretPurpose) => Promise<string>;
interface PromptWriter {
    write(value: string): unknown;
}
export interface KeysCliDependencies {
    readonly config?: Config;
    readonly keystore?: KeystoreOptions;
    readonly env?: NodeJS.ProcessEnv;
    readonly readSecret?: KeysSecretReader;
    readonly stdin?: NodeJS.ReadStream;
    readonly promptOutput?: PromptWriter;
    readonly write?: (value: string) => void;
    readonly fetch?: typeof fetch;
    readonly keyCheckFetch?: typeof fetch;
    /** Test/embedding seam; production deliberately defaults to the existing key checker. */
    readonly validateKeys?: (cfg: Config, env: NodeJS.ProcessEnv) => Promise<KeyCheckResult[]>;
    readonly envFilePath?: string;
    readonly attachControlHeaders?: (cfg: Config, headers: Record<string, string>) => Record<string, string>;
}
export declare class KeysCliError extends Error {
    constructor(message: string);
}
export declare const KEY_CUSTODY_THREAT_BOUNDARY: string;
/**
 * One-line secret input. TTY input is handled by readline in terminal/raw mode while its output
 * is muted after the prompt; closing and every failure path restore the caller's raw-mode state.
 * Each piped prompt consumes one logical line from a shared reader and never prints a prompt.
 */
export declare function readMaskedOrPipedLine(prompt: string, input?: NodeJS.ReadStream, output?: PromptWriter): Promise<string>;
export declare function runKeysAddLocal(cfg: Config, provider: string | undefined, options?: {
    readonly label?: string;
    readonly envName?: string;
    readonly check?: boolean;
}, deps?: KeysCliDependencies): Promise<void>;
export declare function runKeysListLocal(cfg: Config, deps?: KeysCliDependencies): void;
export declare function runKeysRotateLocal(cfg: Config, credential: string | undefined, deps?: KeysCliDependencies): Promise<void>;
export declare function runKeysRevokeLocal(id: string | undefined, deps?: KeysCliDependencies): void;
export declare function runKeysRemoveLocal(id: string | undefined, purge: boolean, deps?: KeysCliDependencies): void;
export declare function runKeysDisableLocal(id: string | undefined, deps?: KeysCliDependencies): void;
export declare function runKeysEnableLocal(id: string | undefined, deps?: KeysCliDependencies): void;
export declare function runKeysExportLocal(outPath: string | undefined, deps?: KeysCliDependencies): Promise<void>;
export declare function runKeysImportLocal(cfg: Config, importPath: string | undefined, deps?: KeysCliDependencies): Promise<void>;
export declare function runKeysUnlockLocal(deps?: KeysCliDependencies): Promise<void>;
export {};