import type { KeyWrapContext, KeyWrapper, WrappedDataKey } from './KeyWrapper';
export declare const LOCAL_KEYCHAIN_WRAP_AAD_PURPOSE = "xpod.ai-gateway.local-keychain-dek-wrap";
export declare const LOCAL_KEYCHAIN_WRAP_AAD_VERSION = "v1";
export interface LocalSecureStore {
    getSecret(key: string): Promise<string | null>;
    setSecret(key: string, value: string): Promise<void>;
    getOrCreateSecret?(key: string, create: () => Promise<string>): Promise<string>;
}
export interface LocalKeychainWrapperOptions {
    secureStore: LocalSecureStore;
    keyId: string;
    keyVersion?: string;
}
/**
 * @deprecated Compatibility-only adapter. Production Xpod bootstrap uses the
 * generic Pod SecretCell keyring configured through XPOD_SECRET_CELL_*.
 */
export declare class LocalKeychainWrapper implements KeyWrapper {
    private readonly secureStore;
    private readonly keyId;
    private readonly keyVersion?;
    constructor(options: LocalKeychainWrapperOptions);
    wrapDek(context: KeyWrapContext, dek: Uint8Array): Promise<WrappedDataKey>;
    unwrapDek(context: KeyWrapContext, wrapped: WrappedDataKey): Promise<Uint8Array>;
    private getOrCreateMasterKey;
    private getExistingMasterKey;
}