import { type CredentialStore } from './credential-store.js';
export declare function getApiKey(email: string, accountsDirPath: string): string | null;
export declare function setApiKey(email: string, key: string, accountsDirPath: string, deps?: {
    credentials?: CredentialStore;
}): void;
export declare function removeApiKey(email: string, accountsDirPath: string): boolean;
/**
 * One-shot migration: walks the accounts dir, copies any plaintext
 * `_apiKey` field into the active credential vault. Idempotent — running it
 * twice is harmless. Called from the CLI entry-point on every platform so the
 * upgrade path is silent (the name is historical; the default vault is the
 * file store, not the Keychain).
 *
 * The JSON `_apiKey` field is intentionally NOT removed by this pass —
 * it stays as a one-major fallback in case the vault entry is lost.
 * Removal happens in v4.
 *
 * Returns the count of accounts migrated. Errors per-account are
 * swallowed so a single failed write doesn't break the whole pass.
 */
export declare function migrateApiKeysToKeychain(accountsDirPath: string): number;
/** sk-ant-api03-…WXYZ — keeps the prefix for source identification, last 4 for confirmation. */
export declare function maskApiKey(key: string): string;