import { KeytarSecretsStore } from './keytar-store.js';
import { FileSecretsStore } from './file-store.js';
/** Service name used as the keytar collection. */
export declare const KEYTAR_SERVICE = "sereus-cadre-host";
/**
 * Abstract credential store. Keys are opaque to the store
 * (e.g. "ddns:duckdns:token").
 */
export interface SecretsStore {
    set(account: string, value: string): Promise<void>;
    get(account: string): Promise<string | null>;
    delete(account: string): Promise<boolean>;
    list(): Promise<string[]>;
}
export { KeytarSecretsStore, FileSecretsStore };
/**
 * Try the OS keychain (keytar) first; fall back to a 0600 JSON file in the
 * cadre-host rootDir. The fallback path is documented in `docs/cadre-host.md`.
 *
 * `keytar` is loaded via dynamic import inside a try/catch so a missing native
 * dependency never crashes package import. The same applies to runtime errors
 * (some Linux desktops have keytar installed but no DBus secret service).
 */
export declare function createSecretsStore(rootDir: string): Promise<SecretsStore>;
/**
 * Return the first candidate in `[mod, mod.default]` that satisfies the
 * `KeytarLike` shape — or `null` if neither does. Handles the CJS-via-ESM
 * interop case where the dynamic import yields `{ default: keytar }` rather
 * than the keytar surface directly.
 */
export declare function resolveKeytarLike(mod: unknown): KeytarLike | null;
/** Subset of keytar's surface that KeytarSecretsStore uses. */
export interface KeytarLike {
    setPassword(service: string, account: string, password: string): Promise<void>;
    getPassword(service: string, account: string): Promise<string | null>;
    deletePassword(service: string, account: string): Promise<boolean>;
    findCredentials(service: string): Promise<Array<{
        account: string;
        password: string;
    }>>;
}
/** Build the keytar account key for a DDNS credential. */
export declare function ddnsAccount(providerId: string, fieldKey: string): string;