/**
 * Keys that survive closing the terminal.
 *
 * KONECK held a typed key in memory and said so proudly: "the key is held in memory only — KONECK
 * has not written it anywhere", followed by advice to put an export line in a shell profile. That
 * is a defensible position for a tool nobody has to use twice. In practice it meant entering the
 * same key on every launch of the web UI, and a key that works in the terminal while the browser
 * on the same machine reports none — because the two were keeping separate copies of something the
 * user reasonably thought they had configured once.
 *
 * Every comparable tool persists. Claude Code keeps credentials under its own home directory or
 * the OS keychain, Codex writes auth.json, the Gemini CLI keeps a file too. So this writes one as
 * well, with the properties that make it defensible rather than merely convenient:
 *
 *   - one file, `~/.koneck/credentials.json`, mode 0600 inside a 0700 directory, so a permissive
 *     umask on a shared machine cannot leave it group-readable;
 *   - written atomically through a temporary file and a rename, so a crash cannot leave half a
 *     credential behind and a symlink planted at the path is not followed;
 *   - keyed by provider, because a key belongs to the endpoint that issued it and there are
 *     several — the older single global apiKey could not express "OpenRouter but not OpenCode";
 *   - and never consulted ahead of the environment, so an exported variable still wins and a
 *     rotated key does not have to be hunted down in a file first.
 *
 * An environment variable fed from a password manager is still the better answer, and the notices
 * keep saying so. This is the answer for the case where somebody has decided otherwise.
 */
/** Where the file lives. `home` is for tests, which must never touch the real one. */
export declare function credentialsPath(home?: string): string;
/** Which providers have a key stored. Names only — callers that want a value ask for one. */
export declare function storedProviders(home?: string): string[];
/** The stored key for a provider, if there is one. */
export declare function storedKeyFor(provider: string, home?: string): string | undefined;
/** Writes a key for one provider, leaving the others alone. Returns the file it went into. */
export declare function rememberKey(provider: string, key: string, home?: string): string;
/** Removes one provider's key. Returns whether there was one to remove. */
export declare function forgetKey(provider: string, home?: string): boolean;
/** Removes every stored key. What /logout means once there is more than one. */
export declare function forgetAllKeys(home?: string): string[];
/**
 * The same key remembered for two different providers.
 *
 * Found on a real machine: one key stored under both `openrouter` and `agentrouter`, identical
 * fingerprints. Whichever of the two was intended, the other entry means a credential issued by
 * one company is sent to another company's endpoint the moment that provider is used — not a key
 * that fails, a key that is disclosed. The usual cause is entering it while a different provider
 * was selected, which is exactly the mis-filing that used to happen silently.
 *
 * Reported, not repaired: only the person who owns the key knows which entry was meant.
 */
export declare function crossFiledKeys(home?: string): Array<{
    providers: string[];
}>;
//# sourceMappingURL=credentials.d.ts.map