import type { CredentialRef } from "@yanlinglabs/winter-agent-sdk";
import type { KeychainSeam } from "../seams/keychain.js";
export interface FakeKeychain extends KeychainSeam {
    /** Stores material for a ref, keyed the same way `read` looks it up. */
    set(ref: CredentialRef, material: string): void;
    /** Every `read` this double served, in order — so a test can prove the fetch happened at spawn. */
    readonly reads: CredentialRef[];
}
/**
 * An in-memory `KeychainSeam`. NEVER `Bun.secrets`, never the OS keychain.
 *
 * An unset ref reads `undefined`, which is the seam's own documented "the host has none" answer —
 * so the missing-credential path is testable without arranging for a real keychain to be empty.
 */
export declare function createFakeKeychain(initial?: Array<{
    ref: CredentialRef;
    material: string;
}>): FakeKeychain;
/**
 * A fresh temp directory that is removed whatever the body does.
 *
 * `mkdtemp` under the OS temp root, never a path built from a home directory: the point is a
 * directory this process created and this process owns.
 */
export declare function withTempDir<T>(prefix: string, fn: (dir: string) => Promise<T>): Promise<T>;
/**
 * The home directories a hermetic official-branch test needs: a throwaway `HOME` and a throwaway
 * `CLAUDE_CONFIG_DIR`, both under one temp root that is removed in a `finally`.
 */
export declare function withHermeticHomes<T>(fn: (homes: {
    home: string;
    claudeConfigDir: string;
}) => Promise<T>): Promise<T>;