/**
 * Which key oh-my-plumb has, and where it goes. A TypeSafe key talks to Jev
 * directly; a gateway key goes through the user's Vercel AI Gateway.
 */
export type Credentials = {
    kind: "typesafe";
    key: string;
    from: string;
} | {
    kind: "gateway";
    key: string;
    from: string;
} | {
    kind: "none";
};
export declare const KEY_NAMES: readonly string[];
export declare const userEnvPath: () => string;
/** Only the named keys are read from a file (the two oh-my-plumb keys unless told otherwise); nothing else in it is touched or loaded. */
export declare const parseEnvFile: (text: string, names?: readonly string[]) => Map<string, string>;
export declare const findCredentials: (root: string) => Credentials;
export declare const resolveCredentials: (root: string) => Credentials;
export declare const credentials: () => Credentials;
export declare const hasApiKey: (root: string) => boolean;
/** The one file oh-my-plumb may write a key to; see AGENTS.md. */
export declare const saveUserKey: (name: string, key: string) => string;
export declare const NO_KEY_HINT = "No API key found. Run \"oh-my-plumb login\" with your TypeSafe key, or put TYPESAFE_AI_API_KEY in the environment or a .env file at the repo root.";
/** The only way out of a refused key; every message about one ends with it. */
export declare const KEY_REJECTED_HINT = "Checks stay off until the key changes: run oh-my-plumb login with a fresh key.";
/**
 * The warning a session gets when its key has been refused, claimed so it
 * lands once per session: a refused key fails every edit the same way, and
 * nobody needs that said 1528 times.
 */
export declare const rejectedKeyNotice: (root: string, sessionId: string) => string | undefined;
/** The one owner of the no-key error: every command guard runs through here. */
export declare const requireApiKey: (root: string) => void;
//# sourceMappingURL=credentials.d.ts.map