import { type CredentialValueSource, type RawCredentialValues } from "./process-env.js";
/**
 * Credentials held by the operating system for this user, rather than by a
 * shell profile.
 *
 * This is what makes JAM work in an editor launched from a Dock or Start menu.
 * Such an editor never sourced a shell profile, so the MCP child it spawns
 * inherits no `JIRA_*` at all - but it does run as the user, so it can read
 * what the OS is holding for that user.
 *
 * The stored value never appears in a log, an error, or a tool result. It is
 * read into memory, handed to the credential chain, and nothing else.
 */
export type StoredCredentials = {
    baseUrl: string;
    email: string;
    apiToken: string;
};
export type RunResult = {
    status: number | null;
    stdout: string;
    stderr: string;
    error?: NodeJS.ErrnoException;
};
/**
 * Injected by tests so the suite never touches a real keychain.
 *
 * `env` is merged over the inherited environment, and carries only values that
 * are not secret - a file path, say. Secrets travel on stdin.
 */
export type RunFn = (command: string, args: string[], input?: string, env?: Record<string, string>) => RunResult;
export interface SecretStore {
    /** Shown by `jam auth login`. Names the mechanism, never a value. */
    readonly label: string;
    /** Missing or unreadable resolves to undefined - reading never throws. */
    read(): StoredCredentials | undefined;
    /** Throws on failure: the user just asked for this and must not be told it worked. */
    write(values: StoredCredentials): void;
    /** Succeeds when there was nothing to remove. */
    clear(): void;
}
/** Raised when the platform's backend is absent, as opposed to empty. */
export declare class SecretStoreUnavailableError extends Error {
    readonly remedy: string;
    constructor(message: string, remedy: string);
}
export declare function secretStoreDisabled(env?: NodeJS.ProcessEnv): boolean;
/**
 * The store for this system, or undefined when there is none that works.
 *
 * Being on Linux is not the same as having a secret store: a headless server or
 * a container routinely has no libsecret and no session keyring. So the backend
 * is probed, not assumed from `process.platform`.
 */
export declare function resolveSecretStore(run?: RunFn, env?: NodeJS.ProcessEnv): SecretStore | undefined;
/**
 * The credential chain's view of the store.
 *
 * Fail-soft by design, like the Windows registry source: a machine with no
 * store, or an empty one, is a normal state that must not turn every command
 * into an error. `jam auth login` is where a failure gets reported, because
 * there the user asked for something specific.
 */
export declare class SecretStoreCredentialSource implements CredentialValueSource {
    private readonly store;
    /**
     * The store is required, with no default that would resolve a real one.
     * A parameter default cannot tell `undefined` meaning "this system has no
     * store" from `undefined` meaning "not supplied" - and getting that wrong
     * silently reaches the user's real keychain, including from a test.
     */
    constructor(store: SecretStore | undefined);
    read(): RawCredentialValues;
}