/**
 * SP4 provider key actions — thin wrappers around the security/key-store module.
 *
 * All side-effecting logic lives here so the TUI components and headless CLI
 * can share the same implementation. Components render results; actions compute
 * them. No Ink/React dependency in this file.
 *
 * Keys are NEVER returned in full — readProviderKey returns a masked form.
 * The full value is only accessible via the key-store module directly (for
 * synthesis calls).
 */
import { PICKER_PROVIDERS } from '../../../security/key-store.js';
import type { LLMProvider } from '../../../integrations/cloud/llm/types.js';
export interface ProviderKeyOpts {
    dataDir: string;
}
export type PickableProvider = LLMProvider | 'custom';
export interface SaveProviderResult {
    ok: boolean;
    /** Where the secret landed; null for custom URL (persisted to config only). */
    location: 'keychain' | 'file' | null;
    error?: string;
}
export interface StoreKeyResult {
    ok: boolean;
    location?: 'keychain' | 'file';
    error?: string;
}
export interface ReadKeyResult {
    /** Masked form of the stored value (e.g. "sk-ant-api0••••••••") */
    masked: string;
    location: 'keychain' | 'file' | 'env';
}
export interface DeleteKeyResult {
    ok: boolean;
    error?: string;
}
export interface ProviderListEntry {
    provider: LLMProvider | 'custom';
    location: 'keychain' | 'file' | 'env';
}
/** Providers shown in the picker UI. groq is hidden (env-only) per spec. */
export { PICKER_PROVIDERS };
/**
 * Store an API key securely for the given provider.
 * Returns the storage location so the TUI can confirm to the user where it went.
 */
export declare function storeProviderKey(provider: LLMProvider, value: string, opts: ProviderKeyOpts): Promise<StoreKeyResult>;
/**
 * Read a stored key and return its masked form + storage location.
 * Returns null when no key is configured for the provider.
 * NEVER returns the full key value — masking is applied here, not in caller.
 */
export declare function readProviderKey(provider: LLMProvider, opts: ProviderKeyOpts): Promise<ReadKeyResult | null>;
/**
 * Delete the stored key for a provider from whichever tier holds it.
 */
export declare function deleteProviderKey(provider: LLMProvider, opts: ProviderKeyOpts): Promise<DeleteKeyResult>;
/**
 * List all providers that have a stored key (keychain or file).
 * Returns provider names + storage locations. Never returns key values.
 */
export declare function listConfiguredProviders(opts: ProviderKeyOpts): Promise<ProviderListEntry[]>;
/**
 * Save a provider selection end-to-end: store the secret in the keystore (or,
 * for custom URLs, persist the URL to config) AND persist the provider block
 * (name + keyLocation) to config.json.
 *
 * config.json NEVER receives the raw key — only the provider name + the
 * location reference. This is the single side-effecting save path so the
 * TUI component stays thin and the no-secret-persistence guarantee is unit-
 * testable here without an Ink render.
 *
 * For provider === 'custom', the `value` is an OpenAI-compatible endpoint URL,
 * not a secret; it is stored in config settings (WIGOLO_LLM_PROVIDER) and the
 * provider block records keyLocation 'env' (custom backend reads the URL at
 * runtime, no API key tier).
 *
 * @param configPath override for tests; defaults to defaultConfigPath()
 */
export declare function saveProviderSelection(provider: PickableProvider, value: string, opts: ProviderKeyOpts, configPath?: string): Promise<SaveProviderResult>;
/**
 * Mask an API key for display. Shows the first 4-8 characters then asterisks.
 * Rule: show at most min(8, ceil(len * 0.25)) characters.
 * A key shorter than 4 chars is fully masked.
 */
export declare function maskValue(value: string): string;
//# sourceMappingURL=provider-keys.d.ts.map