/** Version prefix for keychain-backed BLOBs. ASCII, 20 bytes.
 *  Format A per TED rev 2 §BLOB wire format. */
export declare const AIFIGHT_KEYCHAIN_V1_PREFIX = "AIFIGHT_KEYCHAIN_V1:";
/** Version prefix for fallback AES-256-GCM BLOBs. ASCII, 18 bytes.
 *  Format B per TED rev 2 §BLOB wire format. */
export declare const AIFIGHT_CRYPTO_V1_PREFIX = "AIFIGHT_CRYPTO_V1:";
/** Production default OS keychain service name. Tests MUST override
 *  via AIFIGHT_KEYCHAIN_SERVICE — a build.sh grep (Step 9) will
 *  forbid any test file from hard-coding this literal. */
export declare const AIFIGHT_RUNTIME_SERVICE = "aifight-runtime";
export interface CredentialsBackendInfo {
    readonly backend: "keychain" | "fallback-crypto";
    /** Populated only when backend = "fallback-crypto". Human-readable
     *  reason why the keychain probe failed — useful for diagnostics
     *  in the future `aifight doctor` CLI (M1-17). */
    readonly keychainProbeMessage?: string;
}
/** Internal test-only helper: clears cached backend selection and
 *  cached master key. Call in vitest `beforeEach`/`afterEach` to
 *  isolate cases. NOT re-exported from src/index.ts — test files
 *  import directly from `../src/account/credentials`. */
export declare function resetCredentialsBackendCacheForTests(): void;
/** Backend query. AIFIGHT_FORCE_FALLBACK=1 short-circuits BEFORE the
 *  cache and BEFORE any keychain call — see Roy Step 2+3 constraint #1. */
export declare function getCredentialsBackend(): CredentialsBackendInfo;
export declare function isKeychainAvailable(): boolean;
export declare function encryptForStorage(plaintext: string): Buffer;
export declare function decryptFromStorage(blob: Buffer): string;
export declare function deleteFromStorage(blob: Buffer): void;