/**
 * DB-backed AI configuration store.
 *
 * Storage: a single Document row with `collection = '__ai_config__'` holding
 * `{ providers, settings, catalog }`, mirroring the SEO config-store pattern
 * (`packages/cms-core/src/seo/config-store.ts`). This keeps Phases 1-2 free of a
 * Prisma migration. The per-run usage table arrives in Phase 4.
 *
 * Security invariants:
 *   - Provider API keys are encrypted at rest via `encryptSecret`.
 *   - The encrypted key is NEVER returned to the client; handlers serialize
 *     providers through {@link toPublicProvider}.
 *   - When a provider's env var is set, that key wins and the UI shows it as
 *     env-managed/read-only.
 */
import type { AIBudgetSettings, AIConfigDocument, AIKeySource, AIProviderConnection, AIProviderConnectionPublic, AIProviderKey, AISettings } from './types.js';
export declare const AI_CONFIG_COLLECTION = "__ai_config__";
export declare const DEFAULT_AI_BUDGET: AIBudgetSettings;
export declare function defaultAISettings(): AISettings;
/** Read the env-managed key for a provider, if present and non-empty. */
export declare function getEnvApiKey(provider: AIProviderKey): string | null;
/** Last 4 chars of a key for masked display (never the full value). */
export declare function last4(key: string | undefined | null): string | undefined;
/**
 * Resolve the effective API key for a connection at call time: an env var (if
 * configured for this provider) always wins, otherwise the decrypted stored key.
 * Returns null when neither exists.
 */
export declare function resolveProviderKey(conn: Pick<AIProviderConnection, 'provider' | 'apiKeyEncrypted'>): Promise<string | null>;
/** Determine where a connection's key comes from for UI display. */
export declare function resolveKeySource(conn: AIProviderConnection): AIKeySource;
/** Strip key material and add UI-facing source metadata. */
export declare function toPublicProvider(conn: AIProviderConnection): AIProviderConnectionPublic;
/** Encrypt a plaintext key for storage and compute its masked suffix. */
export declare function encryptProviderKey(plaintext: string): Promise<{
    apiKeyEncrypted: string;
    apiKeyLast4: string;
}>;
/**
 * Read the AI config document. Returns a fully-populated object (defaults +
 * merged feature flags) even when no row exists yet, so callers never special-
 * case the empty state.
 */
export declare function getAIConfig(db: unknown): Promise<AIConfigDocument>;
/**
 * Upsert the AI config document. Caller is responsible for auth/role checks.
 * Stamps `updatedAt`/`updatedBy`.
 */
export declare function putAIConfig(db: unknown, next: AIConfigDocument, userId: string): Promise<AIConfigDocument>;
/** Serialize a full config doc for the client (providers masked). */
export declare function toPublicConfig(doc: AIConfigDocument): {
    providers: AIProviderConnectionPublic[];
    settings: AISettings;
};
//# sourceMappingURL=config-store.d.ts.map