/**
 * Pure JSON serialiser for `olam keys --json`.
 *
 * Kept separate from the command action so the wire contract is
 * unit-testable without a filesystem round-trip (mirrors the pattern
 * used by `auth-list-json.ts`, `repos-list-json.ts`, and
 * `servicesStatusJson` in services.ts).
 *
 * WHY this exists: agent/script drivers (CI pipelines, Rico, flywheel
 * chain skills) need to discover which LLM API keys are configured before
 * spawning worlds that rely on them. The human table is colorized and
 * already applies redaction for display; this serialiser gives drivers a
 * stable, color-free array with the same redaction contract.
 *
 * Secret redaction: key VALUES are sensitive (e.g. `sk-proj-...` for
 * OpenAI, provider tokens, etc.). The serialiser ALWAYS emits redacted
 * values — same `first-8-chars + "..."` convention used by the human
 * renderer — so `olam keys --json` is safe to pipe to CI logs, agent
 * reasoning traces, or Rico digests without leaking secrets.
 *
 * The key NAMES are not secrets (e.g. "OPENAI", "ANTHROPIC") — they are
 * emitted verbatim to let drivers check which providers are configured.
 */
/**
 * Per-key row in the `keys --json` payload.
 * Field names are load-bearing — add new fields freely, never rename.
 */
export interface KeyListJsonEntry {
    /** Key name as stored in keys.yaml (uppercase by convention). */
    readonly name: string;
    /**
     * Redacted key value: first 8 chars + "...".
     * Never the full secret — matches the human renderer's redact() contract.
     */
    readonly redactedValue: string;
}
/** Top-level shape emitted by `olam keys --json`. */
export interface KeysListJson {
    /** Number of configured keys. */
    readonly count: number;
    readonly keys: readonly KeyListJsonEntry[];
}
/**
 * Redact a secret value: keep first 8 chars, replace the rest with "...".
 * Matches the `redact()` helper in keys.ts — deliberately inline so the
 * serialiser has no runtime dependency on the command module.
 */
export declare function redactKeyValue(value: string): string;
/**
 * Serialise the keys map to the stable `--json` wire shape.
 * Accepts null (no file / empty file) and returns an empty payload.
 * Returns a JSON string (no trailing newline — caller adds it).
 */
export declare function renderKeysListJson(keys: Record<string, string> | null): string;
//# sourceMappingURL=keys-list-json.d.ts.map