/**
 * CredentialStore implementation backed by auth.json.
 * Provider auth orchestration belongs to ModelRuntime and pi-ai Models.
 */
import { type AuthOperationOptions, type Credential, type CredentialInfo, type CredentialStore } from "@bastani/pi-ai";
import { type AuthStorageBackend } from "./auth-storage-backends.ts";
export { type AuthStorageBackend, FileAuthStorageBackend, InMemoryAuthStorageBackend, } from "./auth-storage-backends.ts";
export type AuthStorageData = Record<string, Credential>;
export declare class AuthStorage implements CredentialStore {
    private data;
    private loadedVersion;
    private storage;
    private constructor();
    static create(authPath?: string | string[]): AuthStorage;
    static fromStorage(storage: AuthStorageBackend): AuthStorage;
    static inMemory(data?: AuthStorageData): AuthStorage;
    private parseStorageData;
    private readStorageContent;
    /**
     * Reload credentials from storage.
     */
    reload(): void;
    reloadIfChanged(): boolean;
    private readStorageVersion;
    private loadFromStorage;
    /** Read the current in-memory credential snapshot without triggering refresh or I/O. */
    peek(provider: string): Credential | undefined;
    read(provider: string, options?: AuthOperationOptions): Promise<Credential | undefined>;
    modify(provider: string, fn: (current: Credential | undefined) => Promise<Credential | undefined>, options?: AuthOperationOptions): Promise<Credential | undefined>;
    delete(provider: string): Promise<void>;
    /** List credential metadata without resolving configured key values. */
    list(options?: AuthOperationOptions): Promise<readonly CredentialInfo[]>;
}
/**
 * Read credentials without acquiring a lock, creating auth.json, or allowing a
 * refresh to persist a mutation. `auth check --no-refresh` uses this store.
 * It resolves configured key values, including `!command`, like `AuthStorage`.
 * Unlike `AuthStorage.reload()`, malformed data fails closed so the probe can
 * report invalid auth state instead of silently treating it as no credentials.
 */
export declare class ReadOnlyAuthStorage implements CredentialStore {
    private data;
    private readonly storage;
    constructor(authPath?: string | string[]);
    private load;
    /** Raw configured values for privacy screening; never execute API-key commands. */
    peek(providerId: string): Credential | undefined;
    read(providerId: string, options?: AuthOperationOptions): Promise<Credential | undefined>;
    list(options?: AuthOperationOptions): Promise<readonly CredentialInfo[]>;
    modify(_providerId: string, _fn: (current: Credential | undefined) => Promise<Credential | undefined>, _options?: AuthOperationOptions): Promise<Credential | undefined>;
    delete(_providerId: string, _options?: AuthOperationOptions): Promise<void>;
}
/** Read one persisted provider credential using Atomic's layered auth.json paths. */
export declare function readStoredCredential(providerId: string, authPath?: string | string[]): Credential | undefined;
//# sourceMappingURL=auth-storage.d.ts.map