/**
 * Per-plugin encrypted credential store.
 *
 * Layout:
 *   Stdio / HTTP single-user: ~/.<plugin>-mcp/config.json
 *   HTTP multi-user:          ~/.<plugin>-mcp/subs/<sub>/config.json
 *
 * Encryption:
 *   Stdio / single-user: AES-256-GCM with machine-bound key persisted at
 *     ~/.<plugin>-mcp/.secret (auto-generated, 32 bytes, 0600).
 *   HTTP multi-user:    AES-256-GCM with key derived via scrypt from env
 *     CREDENTIAL_SECRET, salt `<plugin>:<sub>`.
 *
 * Replaces deprecated config-file (shared config.enc) which caused
 * multi-daemon path-drift contention with platformdirs version skew.
 */
import { type CredentialBackend } from './backends.js';
export { setHomeDirForTesting } from './home-dir.js';
export declare function credPath(pluginName: string, sub: string | null): string;
export declare class PerPluginStore {
    pluginName: string;
    sub: string | null;
    readonly credPath: string;
    private readonly credKey;
    private readonly backend;
    constructor(pluginName: string, sub?: string | null, backend?: CredentialBackend);
    private key;
    load(): Promise<Record<string, unknown> | null>;
    save(payload: Record<string, unknown>): Promise<void>;
    clear(): Promise<void>;
    /**
     * Whether a credential blob is stored at all, regardless of whether it
     * decrypts. `load()` returns null for both "absent" and "corrupt"; a
     * built-in CLI (`config status` / `doctor`) needs to tell the two apart to
     * report "not configured" vs "corrupt (re-run setup)". Reads only the
     * opaque backend blob, never the plaintext.
     */
    hasStoredBlob(): Promise<boolean>;
}
//# sourceMappingURL=per-plugin-store.d.ts.map