/** Write to a temp file then rename for crash-safe writes. Atomic on POSIX when source and target are on the same filesystem; on Windows, may fail if the target file is locked by another process. Uses PID in the temp file name to avoid clobbering by concurrent CLI processes.
 *
 * When `mode` is provided, chmod runs against the renamed target (POSIX only — Windows ignores POSIX bits, so we skip there). Use 0o600 for files that contain `sk_` secrets.
 */
export declare function atomicWriteFileSync(filePath: string, content: string, mode?: number): void;
export interface Credentials {
    readonly secretKey: string;
    readonly userId: string;
    /** Valid email address, or empty string when the email is unavailable from the credential source. */
    readonly userEmail: string;
}
export type McpClientName = 'Claude Desktop' | 'Cursor' | 'Claude Code' | 'Windsurf' | 'VS Code';
export interface McpClientConfig {
    readonly name: McpClientName;
    readonly configPath: string;
    /** Whether the client's config directory exists on disk (proxy for installation). */
    readonly clientInstalled: boolean;
}
export type McpInstallScope = 'project' | 'user';
/** Thrown by createCredentials when input fails format validation. */
export declare class CredentialValidationError extends Error {
    constructor(message: string);
}
/**
 * Validate and freeze a credentials object.
 * Enforces sk_ prefix with alphanumeric, dash, and underscore characters,
 * UUID format for userId, basic email shape for userEmail, and rejects
 * newlines in email to prevent .env injection.
 */
export declare function createCredentials(input: {
    secretKey: string;
    userId: string;
    userEmail: string;
}): Credentials;
/**
 * Returns a list of known MCP clients with platform-specific config paths.
 *
 * `clientInstalled` is true when the config file's parent directory exists
 * (the client is installed even if not yet configured).
 */
export declare function detectMcpClients(): McpClientConfig[];
/** Merges the Attrove MCP server entry into the given client config, preserving
 *  existing servers. Embeds credentials directly in the server entry's env block —
 *  prefer {@link writeMcpConfigUsingGlobalAuth} when the global auth store is available. */
export declare function writeMcpConfig(client: McpClientConfig, creds: Credentials): void;
/** Writes Attrove MCP config that resolves auth from the global CLI auth store at runtime. */
export declare function writeMcpConfigUsingGlobalAuth(client: McpClientConfig): void;
/** Writes Attrove as a remote OAuth-protected MCP server. */
export declare function writeRemoteMcpConfig(client: McpClientConfig, apiOrigin: string): void;
/**
 * Writes or updates Attrove credentials in a .env file.
 *
 * - Replaces all occurrences of each key (handles duplicates and stale values)
 * - Appends missing keys at the end of the file
 * - Preserves all non-Attrove entries unchanged
 * - No-ops without touching the file when values are already up to date
 */
export declare function writeEnvFile(creds: Credentials, dir?: string): void;
export declare function readEnvCredentials(dir?: string): Credentials | null;
export declare function removeEnvCredentials(dir?: string): boolean;
export declare function removeAttroveFromMcpConfig(configPath: string): boolean;
/** Returns true if the config file contains an attrove MCP server entry. Throws on read/parse errors so callers can surface actionable diagnostics. */
export declare function hasAttroveMcpConfig(configPath: string): boolean;
//# sourceMappingURL=config-writers.d.ts.map