import type { Scope } from '../types.js';
/** The 0600 secrets store: raw relay/bearer tokens for `remoteCanvas.targets`,
 *  kept OUT of `config.json` (which is not permission-hardened and is treated
 *  as shareable/inspectable) and never logged. `crtr canvas config add
 *  --relay-token -` is the ONLY accepted form — reads the raw token from
 *  stdin; any other value is rejected with a generic error (never echoing
 *  what was received). Keyed by `RemoteCanvasTarget.relayTokenRef`, never by
 *  the target name directly, so a rename doesn't orphan the secret. */
export interface SecretsStore {
    relayTokens: Record<string, string>;
}
export declare function readSecrets(scope: Scope): SecretsStore;
/** Writes secrets.json directly (never via `fs-utils.writeJson`, which has no
 *  mode control) so the file is created 0600 from the first byte, then
 *  `chmodSync`s belt-and-suspenders in case the file pre-existed with looser
 *  permissions (e.g. hand-copied from another machine). */
export declare function writeSecrets(scope: Scope, store: SecretsStore): void;
export declare function getRelayToken(ref: string, scope: Scope): string | undefined;
export declare function setRelayToken(ref: string, token: string, scope: Scope): void;
export declare function deleteRelayToken(ref: string, scope: Scope): void;
/** A short, non-reversible display fingerprint of a raw token — safe to print
 *  in `canvas config list`/`show` output. NEVER derive this from anything
 *  that could round-trip back to the token, and never log/return the raw
 *  token itself alongside it. */
export declare function fingerprint(token: string): string;