import { type Credentials } from './config-writers.js';
export type ResolvedCredentials = {
    readonly credentials: Credentials;
    readonly source: 'global';
    readonly profileName: string;
    readonly configPath: string;
} | {
    readonly credentials: Credentials;
    readonly source: 'env';
    readonly profileName: null;
    readonly configPath: null;
};
export declare function getGlobalConfigDir(): string;
export declare function getGlobalConfigPath(): string;
/** Resolves the active (or named) profile's credentials from the global auth store.
 *  SECURITY: returned credentials must never be logged or included in error
 *  messages in full — always mask before display (see maskKey in whoami.ts). */
export declare function readGlobalCredentials(profileName?: string): Credentials | null;
export declare function saveGlobalCredentials(credentials: Credentials, profileName?: string): void;
export declare function removeGlobalCredentials(profileName?: string): boolean;
export declare function resolveStoredCredentials(options?: {
    dir?: string;
    preferEnv?: boolean;
}): ResolvedCredentials | null;
//# sourceMappingURL=auth-store.d.ts.map