export interface KeychainItem {
    service: string;
    /** `YYYYMMDDHHMMSSZ` modified-time — lexicographically sortable. */
    mdat: string;
}
export interface KeychainIO {
    /** Persisted service name for this config dir, or null if none captured yet. */
    readPersisted: (configDir: string) => string | null;
    /** Record the resolved service name for this config dir. */
    persist: (configDir: string, service: string) => void;
    /** All `Claude Code-credentials*` generic-password items with their mdat. */
    listItems: () => KeychainItem[];
    /** The `acct` attribute of the named item, or null if the item is absent. */
    getAccount: (service: string) => string | null;
    /** The OS username — the acct the CLI stores its credentials item under, and
     *  the account the write-through targets. Empty when unknowable. */
    currentAccount: () => string;
    /** Replace the item's password with `blob`. Returns false on any failure. */
    writePassword: (service: string, account: string, blob: string) => boolean;
}
export interface ResolvedKeychain {
    service: string;
    account: string;
}
/** Parse `security dump-keychain` output into `Claude Code-credentials*` items
 *  paired with their mdat. `mdat` precedes `svce` in each block, matching the
 *  dump layout. Pure. */
export declare function parseKeychainItems(dumpOutput: string): KeychainItem[];
/** Parse the `acct` blob from `security find-generic-password` attribute output.
 *  Returns null when no acct attribute is present. Pure. */
export declare function parseKeychainAccount(attrOutput: string): string | null;
/** Resolve the Keychain item for `configDir`, never computing the hash. The
 *  newest hashed item wins (self-heals across a hash rotation); a genuine mdat
 *  tie is broken by the persisted login-writeback name, and an unbreakable tie
 *  returns null (never guess). The write account is the OS username — where the
 *  CLI reads (Task 1441) — falling back to the item's own acct only when the
 *  username is unknowable, so the write-through can never prop up a stale
 *  same-service duplicate under a foreign account. */
export declare function resolveKeychain(configDir: string, io: KeychainIO): ResolvedKeychain | null;
/** Real `security`/filesystem implementation of KeychainIO. Every method absorbs
 *  its own errors so a Keychain fault degrades to token-fallback rather than
 *  throwing into the spawn path. */
export declare function realKeychainIO(): KeychainIO;
/** The OS username, the `acct` the CLI stores its credentials item under. */
export declare function currentAccount(): string;
//# sourceMappingURL=claude-keychain-write.d.ts.map