/**
 * @license
 * Copyright 2025 Vybestack LLC
 * SPDX-License-Identifier: Apache-2.0
 */
import { type KeyringAdapter } from '../storage/secure-store.js';
export interface ToolKeyRegistryEntry {
    toolKeyName: string;
    displayName: string;
    urlParamName: string;
    description: string;
}
export declare const TOOL_KEY_REGISTRY: Map<string, ToolKeyRegistryEntry>;
export declare function isValidToolKeyName(toolName: string): boolean;
export declare function getToolKeyEntry(toolName: string): ToolKeyRegistryEntry | undefined;
export declare function getSupportedToolNames(): string[];
export declare function maskKeyForDisplay(key: string): string;
/**
 * Returns a lazily-created module-level ToolKeyStorage instance.
 * Avoids constructing a new instance on every tool invocation.
 */
export declare function getToolKeyStorage(): ToolKeyStorage;
export type { KeyringAdapter };
export interface ToolKeyStorageOptions {
    toolsDir?: string;
    keyringLoader?: () => Promise<KeyringAdapter | null>;
}
/**
 * Securely stores and retrieves tool API keys.
 *
 * Delegates keychain operations to SecureStore (fallbackPolicy: 'deny').
 * When the keychain is unavailable, falls back to AES-256-GCM encrypted
 * .key files for backward compatibility.
 *
 * Resolution order: keychain (via SecureStore) → encrypted file → keyfile → null
 *
 * @plan PLAN-20260211-SECURESTORE.P08
 * @requirement R7.1
 */
export declare class ToolKeyStorage {
    private readonly toolsDir;
    private readonly keyfilesJsonPath;
    private readonly secureStore;
    private readonly encryptionKey;
    constructor(options?: ToolKeyStorageOptions);
    private assertValidToolName;
    private deriveEncryptionKey;
    private encrypt;
    private decrypt;
    private ensureToolsDir;
    private getEncryptedFilePath;
    private saveToFile;
    private getFromFile;
    private deleteFile;
    private loadKeyfilesMap;
    private saveKeyfilesMap;
    setKeyfilePath(toolName: string, filePath: string): Promise<void>;
    getKeyfilePath(toolName: string): Promise<string | null>;
    clearKeyfilePath(toolName: string): Promise<void>;
    private readKeyfile;
    saveKey(toolName: string, key: string): Promise<void>;
    getKey(toolName: string): Promise<string | null>;
    deleteKey(toolName: string): Promise<void>;
    hasKey(toolName: string): Promise<boolean>;
    resolveKey(toolName: string): Promise<string | null>;
}