/**
 * Auth Token Manager for CLIProxyAPI
 *
 * Manages API key and management secret resolution with inheritance:
 * - Per-variant override → Global config → Default constants
 *
 * Provides secure token generation for user customization.
 */
/**
 * Generate a cryptographically secure token.
 * Uses CSPRNG (crypto.randomBytes) for proper entropy.
 *
 * @param length - Number of random bytes (default: 32 = 256-bit entropy)
 * @returns Base64URL-encoded token (43 chars for 32 bytes)
 */
export declare function generateSecureToken(length?: number): string;
/**
 * Mask a token for display.
 * Shows first 4 and last 4 chars: "ccs_...4f2a"
 * Used by CLI commands and API routes.
 */
export declare function maskToken(token: string): string;
/**
 * Get effective API key with inheritance chain.
 * Priority: variant auth → global cliproxy.auth → default constant
 *
 * @param variantName - Optional variant name for per-variant override
 * @returns Resolved API key
 */
export declare function getEffectiveApiKey(variantName?: string): string;
/**
 * Get effective management secret.
 * Priority: global cliproxy.auth → default constant
 *
 * Note: Management secret is global-only (no per-variant override)
 * as it controls the Control Panel access for the entire CLIProxy instance.
 *
 * @returns Resolved management secret
 */
export declare function getEffectiveManagementSecret(): string;
/**
 * Set global API key.
 * Updates cliproxy.auth.api_key in config.yaml.
 *
 * @param apiKey - New API key (or undefined to reset to default)
 */
export declare function setGlobalApiKey(apiKey: string | undefined): void;
/**
 * Set global management secret.
 * Updates cliproxy.auth.management_secret in config.yaml.
 *
 * @param secret - New management secret (or undefined to reset to default)
 */
export declare function setGlobalManagementSecret(secret: string | undefined): void;
/**
 * Set per-variant API key override.
 * Updates variants[variantName].auth.api_key in config.yaml.
 *
 * @param variantName - Variant name
 * @param apiKey - New API key (or undefined to remove override)
 */
export declare function setVariantApiKey(variantName: string, apiKey: string | undefined): void;
/**
 * Reset all auth settings to defaults.
 * Removes cliproxy.auth and all variant auth overrides.
 */
export declare function resetAuthToDefaults(): void;
/**
 * Get auth configuration summary for display.
 * Returns current effective values and whether they're customized.
 */
export declare function getAuthSummary(): {
    apiKey: {
        value: string;
        isCustom: boolean;
    };
    managementSecret: {
        value: string;
        isCustom: boolean;
    };
};
//# sourceMappingURL=auth-token-manager.d.ts.map