import type { Config } from '../config/schema.js';
export type CredentialType = 'api_key' | 'oauth';
export interface ApiKeyProfile {
    type: 'api_key';
    provider: string;
    profileName?: string;
    envVar?: string | null;
    key: string | null;
}
export interface OAuthToken {
    type: 'oauth';
    provider: string;
    access: string;
    refresh?: string;
    expiresAt?: number;
    scope?: string[];
    createdAt: string;
    updatedAt: string;
}
export type CredentialProfile = ApiKeyProfile;
export interface AuthProfilesFile {
    version: number;
    profiles: Record<string, ApiKeyProfile>;
}
export interface CredentialResolverOptions {
    stateDir?: string;
    /** When set, per-agent auth profiles are read from `resolveAgentAuthProfilesPath(appConfig, agentId)`. */
    agentId?: string;
    /** Required when `agentId` is set. */
    appConfig?: Config;
}
export declare class CredentialResolver {
    private readonly credentialsDir;
    private readonly agentId?;
    private readonly appConfig?;
    constructor(options?: CredentialResolverOptions);
    /**
     * Resolve API key for a provider
     * Priority: Agent private > Global > OAuth > Environment
     */
    resolveApiKey(provider: string): Promise<string | null>;
    /**
     * Check if a provider has credentials configured
     */
    hasCredentials(provider: string): Promise<boolean>;
    /**
     * Which step in {@link resolveApiKey} would supply the key (no secret material).
     */
    resolveApiKeySource(provider: string): Promise<'agent' | 'global' | 'oauth' | 'env' | null>;
    /**
     * List all available credential profiles
     */
    listProfiles(): Promise<Array<ApiKeyProfile & {
        id: string;
        source: 'agent' | 'global';
    }>>;
    /**
     * Plaintext API key from global auth profiles only (no env/oauth fallback).
     * Used by the gateway console reveal endpoint.
     */
    revealGatewayStoredApiKey(provider: string): Promise<string | null>;
    /**
     * Save an API key profile
     */
    saveApiKey(provider: string, key: string, options?: {
        profileName?: string;
        envVar?: string | null;
        agentPrivate?: boolean;
    }): Promise<void>;
    /**
     * Delete a credential profile
     */
    deleteProfile(profileId: string, options?: {
        agentPrivate?: boolean;
    }): Promise<void>;
    /**
     * Load OAuth token for a provider
     */
    loadOAuthToken(provider: string): Promise<OAuthToken | null>;
    /**
     * Save OAuth token for a provider
     */
    saveOAuthToken(provider: string, token: Omit<OAuthToken, 'type' | 'provider' | 'updatedAt'>): Promise<void>;
    private loadFromAgentCredentials;
    private loadFromGlobalCredentials;
    private loadFromEnv;
    private findProfileForProvider;
    private loadAuthProfilesFile;
    private loadAgentAuthProfilesFile;
    private saveGlobalAuthProfile;
    private saveAgentAuthProfile;
    private deleteGlobalAuthProfile;
    private deleteAgentAuthProfile;
}
export declare function getCredentialResolver(options?: CredentialResolverOptions): CredentialResolver;
export declare function resolveApiKey(provider: string, options?: CredentialResolverOptions): Promise<string | null>;
export declare function hasCredentials(provider: string, options?: CredentialResolverOptions): Promise<boolean>;
