/**
 * Cross-platform OS keychain adapter (ADR-306) — macOS Keychain, Windows
 * Credential Manager (DPAPI), Linux Secret Service (libsecret), backed by
 * `@napi-rs/keyring` (prebuilt N-API binaries per platform, wraps the Rust
 * `keyring-rs` crate — no node-gyp compile step, same "optional native
 * binding" shape this monorepo already tolerates for `ruvector`).
 *
 * `keytar` was considered and rejected: archived by the Electron team,
 * compiles from source via node-gyp at install time.
 *
 * ADR-306's refresh-token storage rule: OS keychain only, never plain-text
 * config. When no keychain backend is reachable (typical headless Linux —
 * the binding can be present but no D-Bus Secret Service running), the CLI
 * falls back to session-only tokens (never persisted) rather than writing
 * the secret to disk unencrypted — a deliberate usability cost, not a bug.
 * `SessionOnlyKeychainAdapter` is that fallback, made explicit rather than
 * silently degrading.
 *
 * @module v3/security/keychain-adapter
 */
export interface KeychainAdapter {
    /**
     * A real write+read+delete canary probe against a throwaway entry — not
     * just "did the native module load". A headless box can have the binding
     * present but no reachable Secret Service, which only a real round-trip
     * reveals.
     */
    isAvailable(): Promise<boolean>;
    setSecret(service: string, account: string, secret: string): Promise<void>;
    getSecret(service: string, account: string): Promise<string | null>;
    deleteSecret(service: string, account: string): Promise<void>;
}
/** In-memory-only fallback — the ADR-306-mandated degrade path, not an error state. */
export declare class SessionOnlyKeychainAdapter implements KeychainAdapter {
    private readonly store;
    private key;
    isAvailable(): Promise<boolean>;
    setSecret(service: string, account: string, secret: string): Promise<void>;
    getSecret(service: string, account: string): Promise<string | null>;
    deleteSecret(service: string, account: string): Promise<void>;
}
/**
 * Selects a real OS keychain when reachable, falling back to
 * `SessionOnlyKeychainAdapter` otherwise. Always resolves — never throws —
 * so callers can treat "no keychain" as a normal, expected outcome.
 */
export declare function createKeychainAdapter(): Promise<KeychainAdapter>;
//# sourceMappingURL=keychain-adapter.d.ts.map