/**
 * ChannelStore — the "vault" for channel tokens (SH1 part 3).
 *
 * `FileChannelStore` persists channel configs **encrypted at rest** (AES-256-GCM),
 * mode 0600, so bot tokens never sit in plaintext on disk. The key comes from
 * `OWNWARE_CHANNEL_SECRET` (derived via scrypt) or a per-install random key file.
 * `InMemoryChannelStore` is for tests.
 *
 * This is separate from the gateway's model-credential vault on purpose:
 * channel tokens belong to the channel runner (a gateway *client*), not to the
 * agent — keeping channels outside the engine (the whole Shuttle principle).
 */
import type { ChannelConfig } from './config.js';
export interface ChannelStore {
    list(): Promise<ChannelConfig[]>;
    get(id: string): Promise<ChannelConfig | undefined>;
    put(config: ChannelConfig): Promise<void>;
    remove(id: string): Promise<void>;
}
export declare class InMemoryChannelStore implements ChannelStore {
    private readonly map;
    list(): Promise<ChannelConfig[]>;
    get(id: string): Promise<ChannelConfig | undefined>;
    put(config: ChannelConfig): Promise<void>;
    remove(id: string): Promise<void>;
}
export interface FileChannelStoreOptions {
    /** Directory for the encrypted store + key (e.g. `~/.ownware/channels`). */
    readonly dir: string;
    /** Master secret; if omitted a per-install random key file is used. */
    readonly secret?: string;
}
export declare class FileChannelStore implements ChannelStore {
    private readonly file;
    private readonly key;
    constructor(opts: FileChannelStoreOptions);
    private read;
    private write;
    list(): Promise<ChannelConfig[]>;
    get(id: string): Promise<ChannelConfig | undefined>;
    put(config: ChannelConfig): Promise<void>;
    remove(id: string): Promise<void>;
}
//# sourceMappingURL=store.d.ts.map