import type { Credential, CredentialInfo, CredentialStore } from '@earendil-works/pi-ai';
type AuthFileData = Record<string, Credential>;
export declare function defaultAuthPath(): string;
/**
 * Resolve a stored api-key value the way pi does before handing it to a provider: a leading
 * `!` runs the rest as a shell command (cached for the process), and `$VAR` / `${VAR}`
 * interpolate from the credential's own env then `process.env` (`$$` and `$!` escape a
 * literal `$`/`!`); an unset reference resolves the whole value to undefined. pi's resolver
 * is internal to the coding agent and its credential store — which crouter replaces — is the
 * only place it runs, so an auth.json holding `"key": "$ANTHROPIC_API_KEY"` would otherwise
 * be sent to the provider verbatim.
 */
export declare function resolveCredentialValue(config: string, env?: Record<string, string>): string | undefined;
/** Read all stored credentials. Lock-free: every writer replaces auth.json by atomic
 *  rename, so a reader either sees the old whole file or the new one. Taking the lock here
 *  would be pure cost — pi asks for every registered provider (~75 reads) each time it
 *  builds a model runtime, and those contended acquisitions cost seconds per broker boot. */
export declare function readAuthCredentials(authPath?: string): Promise<AuthFileData>;
/** Read one provider's stored credential. */
export declare function readAuthCredential(providerId: string, authPath?: string): Promise<Credential | undefined>;
/** Persist one provider's credential under the auth.json lock, leaving every other entry intact. */
export declare function setAuthCredential(providerId: string, credential: Credential, authPath?: string): Promise<void>;
/** Remove one provider's credential (logout) under the auth.json lock. */
export declare function deleteAuthCredential(providerId: string, authPath?: string): Promise<void>;
/**
 * The `CredentialStore` crouter hands to `ModelRuntime`. Backed directly by auth.json rather
 * than by an in-memory cache, so `modify` is a real cross-process read-modify-write: pi's
 * locked OAuth refresh inside `Models.getAuth()` and crouter's own credential writes serialize
 * against each other on one lock.
 */
export declare class CrouterCredentialStore implements CredentialStore {
    private readonly authPath;
    private readonly file;
    constructor(authPath?: string);
    read(providerId: string): Promise<Credential | undefined>;
    list(): Promise<readonly CredentialInfo[]>;
    modify(providerId: string, fn: (current: Credential | undefined) => Promise<Credential | undefined>): Promise<Credential | undefined>;
    delete(providerId: string): Promise<void>;
}
export {};