import { type EngineHealthEntry } from '../search/core/engine-health.js';
/**
 * Mask an API key for display in doctor output.
 * Shows at most 8 characters (or 25% of the key length) then asterisks.
 * Never returns the full key value.
 */
export declare function maskApiKey(value: string): string;
/**
 * Format provider/key-location/masked-value lines for doctor output.
 * Returns one or more display lines. Key value is ALWAYS masked.
 */
export declare function formatProviderDoctorLines(provider: string, location: 'keychain' | 'file' | 'env', keyValue: string): string[];
/**
 * Format the engine-health summary for doctor output. Pure so the lines can
 * be asserted from tests without spinning up the whole CLI. Returns one
 * string per line (no trailing newlines). Slice S11a — adds per-engine
 * status visibility for the cold-start health check.
 *
 *   ok        → "  bing            general    ok"
 *   needs-key → "  github-code     code       needs-key (set WIGOLO_GITHUB_TOKEN ...)"
 *   disabled  → "  brave           general    disabled (set BRAVE_API_KEY ...)"
 *
 * Sorted by vertical then engine name so the same registry produces the
 * same output every run.
 */
export declare function formatEngineHealthLines(entries: EngineHealthEntry[]): string[];
/**
 * Build the `tls_tier` doctor line. Pure so it stays unit-testable.
 *
 *   WIGOLO_TLS_TIER=off  → `off (default)`
 *   WIGOLO_TLS_TIER=auto → `auto (chrome_142, wreq-js ✓)` when wreq-js loaded
 *                          `auto (wreq-js missing — fallback only)` when not
 *   WIGOLO_TLS_TIER=on   → `on (chrome_142, wreq-js ✓)` etc.
 */
export declare function formatTlsTierLine(mode: 'off' | 'auto' | 'on', browser: string, wreqAvailable: boolean): string;
/**
 * Exit code contract:
 * - 0 when all required components OK, or only optional packages (content extractor/ML reranker) missing.
 * - 1 when any required component is degraded: Python missing, browser missing,
 *   search engine bootstrap failed/no_runtime, or search engine process supposed to be up but isn't.
 */
export declare function runDoctor(dataDir: string): Promise<number>;
export declare function isPostExitNativeNoise(line: string): boolean;
/**
 * Doctor isolation wrapper.
 *
 * `runDoctor` loads the embedding model (onnxruntime-node) to verify it
 * works. Onnxruntime owns a global thread pool that races libc++ during
 * static-destructor teardown on macOS, surfacing as
 * `mutex lock failed: Invalid argument` and a SIGABRT (exit 134) AFTER the
 * diagnostic output has already been written. The crash is unrecoverable
 * from JS — `session.release()`, `process.reallyExit`, and the SIGABRT
 * handler all run too early; the abort fires during C++ global dtors when
 * the JS VM is gone.
 *
 * Fix: run doctor in a child process. The child inherits stdio so the user
 * sees identical output, runs the diagnostic, writes its intended exit code
 * to a sentinel file, then exits. The parent never loads onnxruntime so its
 * own exit is clean. If the child crashes with SIGABRT (134) after the
 * sentinel was written, we know the diagnostic completed and we use the
 * sentinel code. Any other crash propagates as a real failure.
 */
export declare function runDoctorIsolated(dataDir: string): Promise<number>;
export declare function runDoctorAsChild(dataDir: string): Promise<number>;
//# sourceMappingURL=doctor.d.ts.map