/**
 * {@link AuthProfileStore} implementations.
 *
 * - {@link NoopAuthProfileStore}: returns nothing; used by tests and as a safe
 *   fallback when no agent context is available.
 * - {@link DiskAuthProfileStore}: persists per-agent profiles under
 *   `<stateDir>/agents/<agentId>/auth-profiles.json` with a lazy in-memory
 *   cache and atomic writes. Used by the gateway and CLI to host OAuth
 *   tokens (Codex / Anthropic) without leaking them through env vars.
 *
 * Capability providers stay synchronous: `getApiKeySync` / `hasCredentialSync`
 * read the cached snapshot. Async members (`save`, `refresh`) are only used
 * by vendor-specific code that explicitly opts in to OAuth flows.
 */
import type { AuthProfile, AuthProfileStore } from './types.js';
export declare class NoopAuthProfileStore implements AuthProfileStore {
    getApiKeySync(): string | undefined;
    hasCredentialSync(): boolean;
    list(): AuthProfile[];
    get(): AuthProfile | undefined;
    save(): Promise<void>;
    refresh(profile: AuthProfile): Promise<AuthProfile>;
}
/**
 * Persistent per-agent credential store.
 *
 * File layout (`<stateDir>/agents/<agentId>/auth-profiles.json`):
 *
 * ```json
 * {
 *   "version": 1,
 *   "profiles": [
 *     { "provider": "openai", "profileId": "default", "mode": "api-key", "apiKey": "sk-..." },
 *     { "provider": "openai", "profileId": "codex",   "mode": "oauth",
 *       "oauthAccessToken": "...", "oauthRefreshToken": "...", "expiresAt": 1714000000000 }
 *   ]
 * }
 * ```
 *
 * - Constructor is non-blocking; the first read triggers a sync load.
 * - Writes go through a temp file + `renameSync` so partial writes never
 *   leave the JSON corrupted.
 */
export declare class DiskAuthProfileStore implements AuthProfileStore {
    private readonly path;
    private cache;
    private writeChain;
    constructor(filePath: string);
    /** Absolute path to the backing JSON file. */
    get filePath(): string;
    getApiKeySync(providerId: string, profile?: string): string | undefined;
    hasCredentialSync(providerId: string, profile?: string): boolean;
    list(providerId: string): AuthProfile[];
    get(providerId: string, profileId?: string): AuthProfile | undefined;
    /**
     * Persist a profile. Uses a serial write chain so concurrent saves cannot
     * race each other on the JSON document.
     */
    save(profile: AuthProfile): Promise<void>;
    /**
     * Default `refresh()` is a no-op. Vendor-specific OAuth refresh logic
     * (Codex / Anthropic) lives in `src/providers/auth-runtime/oauth.ts` and
     * calls `save()` here once it has a fresh token.
     */
    refresh(profile: AuthProfile): Promise<AuthProfile>;
    private ensureLoaded;
    private findProfile;
    private persist;
}
export declare function getDefaultAuthProfileStore(): AuthProfileStore;
/**
 * Override the default store. Returns a function that restores the previous
 * store; tests typically call it in `afterEach`.
 */
export declare function setDefaultAuthProfileStore(store: AuthProfileStore): () => void;
/**
 * Get (or create) a {@link DiskAuthProfileStore} for the given agent
 * directory. Same `agentDir` always returns the same store instance so the
 * in-memory cache stays consistent within one process.
 */
export declare function ensureDiskAuthProfileStore(agentDir: string): DiskAuthProfileStore;
/**
 * Convenience: list every profile for a provider via either an explicit
 * store or the default store.
 */
export declare function listProfilesForProvider(store: AuthProfileStore | undefined, providerId: string): AuthProfile[];