/** The on-disk shape of a key file, identical in both keystores so a file copied from one
 *  to the other (or handed to another machine) loads unchanged. */
export interface KeyFile {
    actorId: string;
    privateKey: string;
    /** The actor's kind, when the writer knew it. Absent in files written before #98; readers
     *  fall back to the id prefix, which is what the CLI already does. */
    actorKind?: "human" | "ai_agent" | "ci_bot";
}
export declare function configHome(injected?: string): string;
/** The directory holding this machine's PRIVATE keys — one JSON file per actor id.
 *  A `private/` subdirectory rather than the config home itself, so the layout matches
 *  a repo's `<store>/private/` exactly and later machine-level config cannot collide
 *  with an actor id. */
export declare function machineKeystoreDir(home?: string): string;
/**
 * Reject an actor id that cannot be a single filename.
 *
 * Repo-local storage made a traversing id ("../../x") escape a checkout; the keystore is
 * machine-global, so the same id would now escape the user's config home. Actor ids in
 * practice are `kind:name` ("human:h", "ci:bot"), so nothing legitimate is refused.
 */
export declare function assertKeyFilename(actorId: string): void;
export declare function machineKeyPath(actorId: string, home?: string): string;
/** Create the keystore with credential modes. `mkdir`'s `mode` is masked by the process
 *  umask and ignored entirely for a directory that already exists, so pin both levels
 *  explicitly — 0700 is part of the contract here, not a nicety. */
export declare function ensureKeystoreDir(home?: string): Promise<string>;
/** Write a private key into the machine keystore, 0600. Returns the path written. */
export declare function saveMachineKey(rec: KeyFile, home?: string): Promise<string>;
/** Read a key file from either keystore. Returns null when absent or unparseable — a
 *  corrupt file must not be louder than a missing one, because both mean "cannot sign". */
export declare function readKeyFile(path: string): Promise<KeyFile | null>;
/** The private key this machine holds for `actorId`, or null. */
export declare function loadMachineKey(actorId: string, home?: string): Promise<string | null>;
/** Actor ids this machine holds a private key for. Ids only — key material must never
 *  travel with a listing, or `key ls` becomes the disclosure it exists to help avoid. */
export declare function listMachineKeys(home?: string): Promise<string[]>;
/** Whether the repo→machine migration of #98 is allowed to copy a key out of a checkout.
 *  Off-switchable because moving credentials is something a user must be able to refuse —
 *  on a shared build box, a repo-local CI identity may be deliberately confined there. */
export declare function adoptionEnabled(): boolean;
//# sourceMappingURL=keystore.d.ts.map