/**
 * LLM credential pool accessor — the encrypting writer and reader of the
 * global `accounts` table (T13715 · T13528).
 *
 * `cleo llm add` and every other pool writer store credentials here, so the
 * pool syncs on the home stream: the secret columns hold {@link encryptGlobal}
 * ciphertext under `account:<provider>:<label>` ({@link llmAccountSecretId}),
 * the id the sync sealer (`cloud/secret-seal.ts`) decrypts, seals and
 * re-encrypts under the receiving machine's key. No plaintext secret is ever
 * written to the store, the same way `service-connections-accessor.ts`
 * stores service credentials.
 *
 * Writes go through {@link openDualScopeDb}`('global')` (migrated, captured).
 * Reads are synchronous — the LLM resolver (`resolveCredentials`) cannot
 * await — so they open the global `cleo.db` read-only and decrypt with
 * {@link decryptGlobalSync}. A missing store or table reads as empty.
 *
 * The non-secret fields of a {@link StoredCredential} without a column of
 * their own (`baseUrl`, `extraHeaders`, `metadata`, `disabled`, `lastStatus`)
 * live in the row's `metadata` JSON.
 *
 * @module store/llm-accounts-accessor
 * @task T13715
 * @task T13528
 */
import { type StoredCredential } from '../llm/credentials-store.js';
/**
 * Where the pool lives. Both fields default to the ambient global store.
 *
 * @task T13715
 */
export interface LlmAccountsOptions {
    /** CLEO home whose machine key encrypts the secrets. */
    readonly cleoHome?: string;
    /** Global `cleo.db` to use instead of `<cleoHome>/cleo.db` (a restore target or a test store). */
    readonly dbPath?: string;
}
/**
 * One `accounts` row as stored: secrets still encrypted.
 *
 * @task T13715
 */
export type LlmAccountRow = {
    readonly provider: string;
    readonly label: string;
    readonly auth_type: string;
    readonly secret_enc: string | null;
    readonly refresh_enc: string | null;
    readonly expires_at: string | null;
    readonly priority: number;
    readonly source: string | null;
    readonly last_error_code: string | null;
    readonly cooldown_reset_at: string | null;
    readonly request_count: number;
    readonly metadata: string;
};
/**
 * The {@link encryptGlobal} id of a pool credential's secret columns. The sync
 * sealer derives the same id from the row's natural key.
 *
 * @param provider - The credential's provider.
 * @param label - Its label.
 * @returns `account:<provider>:<label>`.
 * @task T13715
 */
export declare function llmAccountSecretId(provider: string, label: string): string;
/**
 * List the pool's rows, still encrypted, ordered by provider and label. A
 * missing store, or one not yet migrated to carry `accounts`, holds none.
 *
 * @param opts - Which store.
 * @returns The rows.
 * @task T13715
 */
export declare function listLlmAccountRowsSync(opts?: LlmAccountsOptions): LlmAccountRow[];
/**
 * Decrypt one row into a {@link StoredCredential}.
 *
 * @param row - The row.
 * @param opts - Whose machine key decrypts it.
 * @returns The credential, or `null` for a row without a secret (redacted by an
 *   unencrypted backup) or with an unknown provider or auth type.
 * @throws When this machine's key cannot decrypt the secret.
 * @task T13715
 */
export declare function llmAccountToCredentialSync(row: LlmAccountRow, opts?: LlmAccountsOptions): StoredCredential | null;
/**
 * Upsert a credential into the pool, encrypting its secrets under this
 * machine's key. The `(provider, label)` pair is the key.
 *
 * @param credential - The credential.
 * @param opts - Which store and machine key.
 * @task T13715
 * @sync-invariant none:input-shape reads only its own row, by the (provider, label) natural key, to keep an unchanged ciphertext; no other row is read or written
 */
export declare function upsertLlmAccount(credential: StoredCredential, opts?: LlmAccountsOptions): Promise<void>;
/**
 * Delete a credential from the pool.
 *
 * @param provider - Its provider.
 * @param label - Its label.
 * @param opts - Which store.
 * @returns Whether a row was deleted.
 * @task T13715
 */
export declare function deleteLlmAccount(provider: string, label: string, opts?: LlmAccountsOptions): Promise<boolean>;
//# sourceMappingURL=llm-accounts-accessor.d.ts.map