/**
 * User-level configuration for Studiograph
 *
 * Stored at ~/.studiograph/user.json — never committed to git.
 * Holds personal credentials and preferences that should not be shared
 * with the team (API keys, preferred model, etc.).
 *
 * This mirrors the pattern established by ~/.studiograph/auth.json
 * for GitHub tokens.
 */
import type { LanguageModel } from 'ai';
export interface UserR2Config {
    access_key_id: string;
    secret_access_key: string;
}
export interface UserConfig {
    model_provider?: string;
    model_id?: string;
    api_key?: string;
    /** Voyage AI API key for semantic search embeddings (Tier 2). Get at https://www.voyageai.com */
    voyage_api_key?: string;
    /** Path to LanceDB vector store. Defaults to ~/.studiograph/vector */
    vector_db_path?: string;
    /** Enable GraphRAG cross-document context during sync extraction */
    graphrag_enabled?: boolean;
    r2?: UserR2Config;
    /** Railway API token for deploy/redeploy commands */
    railway_token?: string;
    /**
     * Personal Studiograph API tokens for non-interactive CLI access, keyed
     * by remote server URL (e.g. `https://schemaos.com` → `sg_…`). Minted
     * via `POST /api/auth/tokens`. Never committed to git — lives only in
     * the local user config (mode 0600). Override with the --token flag
     * or STUDIOGRAPH_TOKEN env var.
     */
    studiograph_tokens?: Record<string, string>;
}
export declare const USER_CONFIG_PATH: string;
/**
 * Load the user config from ~/.studiograph/user.json.
 * Returns an empty object if the file does not exist or cannot be parsed.
 */
export declare function loadUserConfig(): UserConfig;
/**
 * Persist the user config to ~/.studiograph/user.json with mode 0600
 * (owner read/write only — keeps API keys off shared file systems).
 *
 * When the encrypted store has been initialized by serve.ts, the
 * registry-mapped fields are mirrored into the store on a best-effort
 * basis (dual-write). The legacy file remains authoritative through
 * Phase 5; Phase 6 flipped the read path. Failures never block the
 * legacy write — see dual-write.ts for the rationale.
 */
export declare function saveUserConfig(config: UserConfig): void;
/**
 * Save model provider, model ID, and optional API key to user config.
 * Merges with any existing user config so other fields are preserved.
 */
export declare function setUserModelConfig(provider: string, modelId: string, apiKey?: string): void;
/** Read the user's personal Studiograph token for a given remote, if any. */
export declare function getStudiographToken(remote: string): string | undefined;
/** Persist the user's personal Studiograph token for a given remote. */
export declare function setStudiographToken(remote: string, token: string): void;
/**
 * Mint a personal sg_ API token via POST /api/auth/tokens and persist it to
 * `~/.studiograph/user.json` keyed by remote. Used after a successful
 * email/password login (clone, the interactive resolveRemoteAuth fallback)
 * so subsequent CLI calls go straight to the token-only auth path.
 *
 * Failure is non-fatal: returns false. The caller already holds a usable
 * JWT cookie for the current session; the owner can re-mint later via
 * `studiograph admin token issue` (A4).
 *
 * Exported (not just internal to sync/clone) so future commands and tests
 * exercise the same minted-token shape.
 */
export declare function mintAndStoreCliToken(serverUrl: string, cookieHeader: string, opts?: {
    name?: string;
    fetchFn?: typeof fetch;
}): Promise<{
    ok: true;
    token: string;
} | {
    ok: false;
    reason: string;
}>;
/** Remove the stored token for a remote (e.g. after a 401). */
export declare function clearStudiographToken(remote: string): void;
/**
 * Resolve the Anthropic credential to pass to the API client.
 * Returns the API key from console.anthropic.com.
 * Note: OAuth tokens are no longer supported per Anthropic's third-party policy.
 */
export declare function getAnthropicCredential(config: UserConfig): string | undefined;
/** Shared config shape for workspace-level model settings */
interface WorkspaceModelConfig {
    api_key?: string;
    model_provider?: string;
    model_id?: string;
}
/**
 * Resolve the model provider.
 *
 * Phase 6 read-flip: try the encrypted store first via the resolver
 * (env > store > default). The legacy chain (workspace config → user
 * config → env → default) is the transitional fallback for when the
 * importer hasn't run yet OR when a workspace config carries an
 * explicit override that the store doesn't know about.
 *
 * Note: `workspaceConfig` here is the LLM-config shape that callers
 * pass through, not the secrets-store workspace scope. We keep it as
 * a fallback because workspace.json may legitimately carry
 * `model_provider`/`model_id` overrides for now (until Phase 9 routes
 * those through the schema validator).
 */
export declare function resolveProvider(userConfig: UserConfig, workspaceConfig?: WorkspaceModelConfig): string;
/**
 * Resolve the model ID.
 *
 * Same Phase 6 ordering as resolveProvider — store first, legacy
 * chain as transitional fallback.
 */
export declare function resolveModelId(userConfig: UserConfig, workspaceConfig?: WorkspaceModelConfig): string;
/**
 * Resolve the API key for the active model provider.
 *
 * Read order:
 *   1. Per-provider store slot — `model.<provider>.api_key`
 *   2. workspace.json → user.json (legacy file chain — local-dev only)
 *   3. env: MODEL_API_KEY → provider-specific → SDK aliases
 *
 * The legacy generic `model.api_key` store slot was decommissioned in
 * Phase 12c (2026-05-12) along with the importer that copied it into
 * per-provider slots. New writes always go through the per-provider
 * surface (UI + CLI).
 */
export declare function resolveApiKey(userConfig: UserConfig, workspaceConfig?: WorkspaceModelConfig): string;
/**
 * Build a Vercel AI SDK model for the given provider/model/key combination.
 * Single factory shared by background generation surfaces that don't go
 * through the agent orchestrator.
 */
export declare function createModel(provider: string, modelId: string, apiKey: string): LanguageModel;
/**
 * Ensure the resolved API key is available in the provider-specific env var.
 * Used by serve.ts so the orchestrator (which reads provider env vars) can find it.
 */
export declare function propagateApiKeyToEnv(userConfig: UserConfig, workspaceConfig?: WorkspaceModelConfig): void;
export {};
