/**
 * Persistent pi-ai credential store — file-backed `CredentialStore` at
 * `~/.openkai/auth.json` (ren review: credentials must survive a restart, the
 * default `InMemoryCredentialStore` forgets OAuth tokens on exit).
 *
 * The file maps provider id → one type-tagged `Credential` (pi-ai's auth.json
 * shape). Writes go exclusively through `modify`/`delete`, serialised on a
 * single in-process promise chain (one shared file means per-provider chains
 * would still race) and persisted atomically (tmp+rename) so a crash
 * mid-write cannot truncate the store. The directory is 0700 and the file
 * 0600 (chmod after every write — a pre-existing loose file gets narrowed),
 * matching the session tree's owner-only rule.
 *
 * Cross-process exclusion is out of scope (the pi-ai interface documents it
 * as "where the backing store supports it"); OpenKai runs one process per
 * terminal. `list` only reads the file — it never resolves auth, so it never
 * executes configured api-key commands (per the interface contract).
 */
import type { AuthOperationOptions, Credential, CredentialInfo, CredentialStore, Models } from "@earendil-works/pi-ai";
/** The OpenKai home directory (~/.openkai or $OPENKAI_HOME for tests). */
export declare function openkaiHome(): string;
/** Path of the credential store file. */
export declare function authFilePath(): string;
/**
 * File-backed {@link CredentialStore}. `read`/`list` resolve `undefined`/
 * empty for a missing file; an unparseable file is treated as empty (a
 * corrupt store is unrecoverable anyway, and bricking all auth behind a
 * parse error is the worse failure). Methods reject only on storage I/O
 * failure, per the pi-ai error-semantics contract.
 */
export declare class FileCredentialStore implements CredentialStore {
    private readonly filePath;
    /**
     * Single write chain serialising every modify/delete. The store is one
     * shared file, so per-provider chains would still race read-modify-write
     * across providers and lose updates; one chain satisfies the interface's
     * per-provider mutual exclusion too.
     */
    private chain;
    constructor(filePath?: string);
    read(providerId: string, _options?: AuthOperationOptions): Promise<Credential | undefined>;
    list(_options?: AuthOperationOptions): Promise<readonly CredentialInfo[]>;
    modify(providerId: string, fn: (current: Credential | undefined) => Promise<Credential | undefined>, _options?: AuthOperationOptions): Promise<Credential | undefined>;
    delete(providerId: string, _options?: AuthOperationOptions): Promise<void>;
    /** Serialise work on the store-wide chain without releasing it early. */
    private enqueue;
    /** Read the whole store (missing/corrupt → empty). */
    private readAll;
    /** Atomic persist: tmp file in the same directory + rename, 0600. */
    private writeAll;
}
/**
 * A pi-ai `Models` collection with every built-in provider registered and the
 * persistent {@link FileCredentialStore} injected, so logins and OAuth
 * refreshes land on disk instead of pi-ai's default in-memory store.
 *
 * The two Ollama lanes (E017) ride alongside the built-ins: they are
 * OpenKai-owned providers (pi-ai's catalogue has no Ollama entry) — the
 * keyless local lane and the OLLAMA_API_KEY cloud lane.
 */
export declare function defaultModels(): Models;
//# sourceMappingURL=credentials.d.ts.map