export type ProvisionedKey = {
    apiKey: string;
    expiresAt?: number;
};
export type ProvisionedKeys = Record<string, ProvisionedKey>;
/** Test seam: reset module state. */
export declare function resetProvisionedKeysForTest(): void;
/**
 * Fetch the org's provisioned keys now (single-flight). Resolves when the
 * attempt settles; never throws. Safe to fire-and-forget.
 */
export declare function refreshProvisionedKeys(opts?: {
    fetchImpl?: typeof fetch;
    /** Test seam: bypass config-derived device auth. */
    auth?: {
        baseUrl: string;
        apiKey: string;
    };
}): Promise<void>;
/**
 * Synchronous lookup of an org-provisioned key. Reads memory, then the disk
 * cache; fires a background refresh when the cache is stale or missing so the
 * NEXT lookup (or reconnect) has it. Expired keys are never returned.
 */
export declare function resolveProvisionedKey(provider: string): string | null;
/**
 * Like resolveProvisionedKey but with the expiry visible — consumers that
 * BAKE a key into static config (the macOS daemon's launchd environment)
 * must reject short-lived keys; only refresh-capable consumers may use them.
 */
export declare function resolveProvisionedKeyEntry(provider: string): ProvisionedKey | null;