/**
 * Credential storage for Dossier registry authentication.
 * Stores per-registry credentials at ~/.dossier/credentials.json with secure file permissions (0600).
 * Auto-migrates old flat format to keyed-by-registry format.
 *
 * Security model:
 * - **HTTPS enforcement**: Registry URLs must use HTTPS (enforced in config.ts when adding
 *   registries) so credentials are never sent over plain HTTP.
 * - **Per-registry isolation**: Each registry has its own credential entry. A compromised
 *   registry token cannot be used to authenticate against other registries.
 * - **Environment variable override**: DOSSIER_REGISTRY_TOKEN creates a virtual "env"
 *   credential entry for CI/CD contexts; it is never persisted to disk.
 */
export interface Credentials {
    token: string;
    username: string;
    orgs: string[];
    expiresAt: string | null;
}
declare const CREDENTIALS_FILE: string;
/**
 * Save credentials for a specific registry.
 */
declare function saveCredentials(credentials: Credentials, registryName?: string): void;
/**
 * Load credentials for a specific registry.
 * Falls back to "public" for backward compatibility.
 */
declare function loadCredentials(registryName?: string): Credentials | null;
/**
 * Delete credentials for a specific registry, or all if no name given.
 */
declare function deleteCredentials(registryName?: string): boolean;
/**
 * Check if credentials are expired.
 */
declare function isExpired(credentials: Pick<Credentials, 'expiresAt'>): boolean;
/**
 * List all registries that have stored credentials.
 */
declare function listCredentialRegistries(): string[];
export { CREDENTIALS_FILE, saveCredentials, loadCredentials, deleteCredentials, isExpired, listCredentialRegistries, };
//# sourceMappingURL=credentials.d.ts.map