/**
 * Persistent state held by each BPService instance:
 *  - apiKey: control-plane API key (delivered via setup)
 *  - cpUrl: control-plane URL (delivered via setup)
 *  - tenantLock: first-tenant lock for auto-single-tenant default
 *
 * Stored encrypted on disk at the configured path. The encryption key is
 * generated (256-bit, CSPRNG) on first use and held in a sibling `.key` file
 * with mode 0600 - it is never operator-supplied, so the KDF always runs over
 * a high-entropy input.
 */
export interface BootstrapStateFile {
    version: 1;
    apiKey?: string;
    cpUrl?: string;
    cpId?: string;
    cpJwksUri?: string;
    configEncryptionKey?: string;
    tenantLock?: string;
    installedAt?: string;
}
export interface BootstrapStateOptions {
    filePath: string;
}
export declare class BootstrapStateStore {
    private cache;
    private readonly filePath;
    private readonly key;
    constructor(options: BootstrapStateOptions);
    read(): BootstrapStateFile;
    write(patch: Partial<BootstrapStateFile>): BootstrapStateFile;
    clear(): void;
    hasApiKey(): boolean;
}
//# sourceMappingURL=bootstrapState.d.ts.map