export declare const AGENT_CLIENT_STORAGE_NAMESPACE_ENV = "BAILINGHUB_AGENT_CLIENT_STORAGE_NAMESPACE";
export type AgentCredentials = {
    schema_version: 1;
    base_url: string;
    client_app_id: string;
    route: string;
    session_id: string;
    access_token: string;
    refresh_token: string;
    access_expires_at: string;
    refresh_expires_at: string;
};
export interface CredentialStore {
    load(): Promise<AgentCredentials | undefined>;
    save(credentials: AgentCredentials): Promise<void>;
    delete(): Promise<void>;
    withRefreshLock?<T>(work: () => Promise<T>): Promise<T>;
    readonly description: string;
}
/**
 * Validates an optional host-owned local-storage namespace.
 *
 * This value is not a connection field or a business identity. It is deliberately constrained
 * to a short lowercase identifier and is hashed before it reaches a path, Keychain account, or
 * lock key. Empty input preserves the historical unnamespaced storage locations exactly.
 */
export declare function normalizeAgentStorageNamespace(value: unknown): string | undefined;
export declare function resolveAgentStorageNamespace(explicitValue: unknown, environment?: NodeJS.ProcessEnv): string | undefined;
/** Opaque filesystem/Keychain-safe segment; never contains the host's raw namespace. */
export declare function agentStorageNamespaceSegment(value: unknown): string | undefined;
export declare function defaultKeychainCredentialAccount(storageNamespace?: string): string;
/** Current-user application data root used only for public metadata and DPAPI ciphertext. */
export declare function defaultWindowsAgentStorageRoot(storageNamespace?: string, environment?: NodeJS.ProcessEnv): string;
export declare function defaultWindowsDpapiCredentialPath(storageNamespace?: string, environment?: NodeJS.ProcessEnv): string;
export declare function defaultWindowsPowerShellPath(environment?: NodeJS.ProcessEnv): string;
/**
 * Crash-safe, cross-process mutex for short local Agent state transitions.
 * The key is hashed before it is mapped to a loopback TCP port and must never contain credentials.
 * The OS releases the listener after a crash; a rare unrelated hash/port collision only serializes
 * the operation or fails closed after the bounded wait.
 */
export declare class LocalAgentOperationLock {
    private readonly port;
    constructor(key: string);
    withLock<T>(work: () => Promise<T>): Promise<T>;
    private tryAcquire;
}
export declare class LocalAgentOperationLockTimeoutError extends Error {
    constructor();
}
type CommandResult = {
    exitCode: number;
    stdout: string;
};
export type CommandRunner = (executable: string, args: string[], input?: string) => Promise<CommandResult>;
export declare function parseAgentCredentials(value: unknown): AgentCredentials;
export declare function createCommandRunner(timeoutMilliseconds?: number): CommandRunner;
export declare const runCommand: CommandRunner;
export declare class MacOsKeychainCredentialStore implements CredentialStore {
    private readonly commandRunner;
    private readonly account;
    readonly description = "macOS Keychain";
    private readonly refreshLock;
    constructor(commandRunner?: CommandRunner, account?: string);
    load(): Promise<AgentCredentials | undefined>;
    save(credentials: AgentCredentials): Promise<void>;
    delete(): Promise<void>;
    withRefreshLock<T>(work: () => Promise<T>): Promise<T>;
}
/**
 * Stores one Agent Session as a CurrentUser DPAPI-protected binary file.
 *
 * The fixed PowerShell programs are passed through -EncodedCommand. Credential JSON, file paths,
 * and the non-secret entropy value travel only through stdin, never process arguments or logs.
 * DPAPI provides the confidentiality and integrity boundary; the file is only ciphertext.
 */
export declare class WindowsDpapiCredentialStore implements CredentialStore {
    private readonly commandRunner;
    readonly description = "Windows DPAPI (CurrentUser)";
    private readonly path;
    private readonly entropy;
    private readonly powerShellPath;
    private readonly refreshLock;
    constructor(path: string, commandRunner?: CommandRunner, account?: string, environment?: NodeJS.ProcessEnv);
    load(): Promise<AgentCredentials | undefined>;
    save(credentials: AgentCredentials): Promise<void>;
    delete(): Promise<void>;
    withRefreshLock<T>(work: () => Promise<T>): Promise<T>;
}
export declare class FileCredentialStore implements CredentialStore {
    private readonly path;
    readonly description: string;
    private readonly refreshLock;
    constructor(path: string);
    load(): Promise<AgentCredentials | undefined>;
    save(credentials: AgentCredentials): Promise<void>;
    delete(): Promise<void>;
    withRefreshLock<T>(work: () => Promise<T>): Promise<T>;
}
export declare class MemoryCredentialStore implements CredentialStore {
    readonly description = "memory";
    private credentials;
    private lockTail;
    constructor(initial?: AgentCredentials);
    load(): Promise<AgentCredentials | undefined>;
    save(credentials: AgentCredentials): Promise<void>;
    delete(): Promise<void>;
    withRefreshLock<T>(work: () => Promise<T>): Promise<T>;
}
export declare function defaultFileCredentialPath(storageNamespace?: string): string;
export declare function selectCredentialStore(environment?: NodeJS.ProcessEnv, platform?: NodeJS.Platform, commandRunner?: CommandRunner, storageNamespace?: string): CredentialStore;
export {};
//# sourceMappingURL=credential-store.d.ts.map