/**
 * Local credential store for the remixmate CLI.
 *
 * Design (see .kiro/specs/cli-device-login/design.md):
 *   - File store at ~/.config/remixmate/credentials.json (mode 0600) is the
 *     REQUIRED, always-present implementation. Entries are keyed by API base
 *     URL so multiple accounts / backends coexist without overwriting.
 *   - The OS keychain is an OPTIONAL enhancement loaded via dynamic import().
 *     When a keychain module is available we keep the secret PrivToken there
 *     and store only non-secret metadata (+ a location marker) in the file.
 *     When it is absent or fails at runtime, the PrivToken is stored in the
 *     file instead. Either way the PrivToken value is never logged.
 *
 * No new runtime dependency is added: keychain support activates only if a
 * compatible module (`keytar`) is already importable in the host environment.
 */
export declare const CRED_DIR: string;
export declare const CRED_FILE: string;
/** A resolved credential as seen by callers (token always populated). */
export interface StoredCredential {
    privToken: string;
    userLabel?: string;
    createdAt: number;
}
/** Result of a remove, so callers (logout) can report partial failures. */
export interface RemoveResult {
    removedFile: boolean;
    removedKeychain: boolean;
    keychainError?: string;
    fileError?: string;
}
/**
 * Persist a credential for `apiBaseUrl`. Prefers the keychain for the secret;
 * falls back to the file on absence or runtime failure. Returns whether the
 * keychain was used so callers can surface "keychain unavailable, used file".
 */
export declare function setCredential(apiBaseUrl: string, cred: StoredCredential): Promise<{
    usedKeychain: boolean;
    keychainError?: string;
}>;
/** Read a credential for `apiBaseUrl`, or null when none is stored. */
export declare function getCredential(apiBaseUrl: string): Promise<StoredCredential | null>;
/** Non-secret summary of one stored entry, for diagnostics (`whoami`, `doctor`). */
export interface CredentialSummary {
    apiBaseUrl: string;
    userLabel?: string;
    createdAt: number;
    secret: 'file' | 'keychain';
}
/**
 * List which backends have a stored credential, WITHOUT reading any secret.
 *
 * Credentials are keyed by API base URL, so "logged in" is per-backend. Without
 * this, a credential stored for a local dev backend while the CLI defaults to
 * production produced a bare "not logged in" — technically true, actively
 * misleading, and the exact confusion that motivated this work.
 */
export declare function listCredentials(): Promise<CredentialSummary[]>;
/** Remove a credential from both stores; reports per-store outcome. */
export declare function removeCredential(apiBaseUrl: string): Promise<RemoveResult>;