/**
 * CredentialStore Effect service — credential storage and auth policy.
 *
 * Tier 1: OS keychain (@napi-rs/keyring)
 * Tier 2: Restricted-permission file (~/.config/axm/credentials.json)
 *
 * CI environments are token-only by policy. Containers use the restricted
 * file tier so agent sessions can complete resumable device authorization.
 *
 * @experimental This API is unstable and may change without notice.
 */
import * as FileSystem from "effect/FileSystem";
import * as Path from "effect/Path";
import * as ServiceMap from "effect/Context";
import type * as DateTime from "effect/DateTime";
import * as Effect from "effect/Effect";
import * as Layer from "effect/Layer";
import * as Option from "effect/Option";
import { type AppError } from "../app-error/index.js";
import { type Handle } from "../extensions/handle.js";
import type { CredentialFile, StorageTier, StoredCredentials } from "./schema.js";
export interface CredentialStoreService {
    readonly save: (registryUrl: string, handle: Handle, credentials: {
        readonly access_token: string;
        readonly refresh_token: string;
        readonly expires_at: DateTime.Utc;
    }) => Effect.Effect<void, AppError>;
    readonly load: (registryUrl: string) => Effect.Effect<Option.Option<StoredCredentials>, AppError>;
    readonly clear: (registryUrl: string) => Effect.Effect<void, AppError>;
    readonly tier: StorageTier;
    readonly allowsPersistedCredentials: boolean;
}
declare const CredentialStore_base: ServiceMap.ServiceClass<CredentialStore, "@agentxm/client-core/unstable/auth/credential-store/CredentialStore", CredentialStoreService>;
export declare class CredentialStore extends CredentialStore_base {
}
export declare const resolveCredentialHomeDir: (config: {
    readonly axmUserHome: Option.Option<string>;
    readonly home: Option.Option<string>;
    readonly userProfile: Option.Option<string>;
    readonly homePath: Option.Option<string>;
}) => string;
export interface EnvironmentInfo {
    readonly isSSH: boolean;
    readonly isContainer: boolean;
    readonly isWSL: boolean;
    readonly isCI: boolean;
    readonly isRoot: boolean;
    readonly isGenericBunExecutable: boolean;
}
export declare const detectEnvironment: Effect.Effect<{
    isSSH: boolean;
    isContainer: boolean;
    isWSL: boolean;
    isCI: boolean;
    isRoot: boolean;
    isGenericBunExecutable: boolean;
}, never, FileSystem.FileSystem>;
/**
 * Select storage tier based on detected environment.
 *
 * Use OS keychain by default, falling back to the restricted file backend when
 * keychain access is unavailable. Whether persistence is allowed is a separate
 * policy decision.
 */
export declare const selectTier: (env: EnvironmentInfo) => StorageTier;
export declare const canUsePersistedCredentials: (env: EnvironmentInfo) => boolean;
export declare const makePersistedCredentialsUnsupportedError: () => AppError;
export declare const CredentialStoreLive: Layer.Layer<CredentialStore, never, Path.Path | FileSystem.FileSystem>;
/**
 * Decorates a credential store with a per-layer, per-origin read memo.
 * Successful empty reads are memoized; failures remain retryable. Every
 * successful write invalidates only the affected origin.
 */
export declare const CredentialStoreSessionLive: Layer.Layer<CredentialStore, never, CredentialStore>;
export declare const CredentialStoreTest: (tier?: StorageTier, initialData?: CredentialFile, allowsPersistedCredentials?: boolean) => Layer.Layer<CredentialStore, never, never>;
export {};
//# sourceMappingURL=credential-store.d.ts.map