import { type CredentialId } from "./credential-id.js";
import { type KekWrapMode, type KeyringOptions } from "./os-keyring.js";
import { type SecretFileAclOptions } from "./secret-file-acl.js";
export interface KeystoreFileStat {
    mtimeMs: number;
    size: number;
    ino: number;
}
declare const keystoreResolutionWalkBrand: unique symbol;
export interface KeystoreResolutionWalk {
    readonly [keystoreResolutionWalkBrand]: true;
}
export interface KeystoreOptions extends KeyringOptions {
    path?: string;
    now?: number;
    /** Injected Windows ACL process/platform seam; separate from the keyring spawner. */
    acl?: SecretFileAclOptions;
    /** Read seam for deterministic filesystem-failure tests. */
    readFile?: (path: string) => string;
    /** Stat seam for deterministic staleness and filesystem-cardinality tests. */
    statFile?: (path: string) => KeystoreFileStat;
    /** Opaque request-resolution scope created with createKeystoreResolutionWalk(). */
    resolutionWalk?: KeystoreResolutionWalk;
}
export interface KeystoreStatus {
    status: "ok" | "absent" | "unreadable" | "locked" | "degraded";
    /** Retained descriptors whose authenticated ciphertext cannot be decrypted. */
    undecryptableCount: number;
    /** Total structurally dropped plus cryptographically undecryptable rows. */
    droppedCount: number;
}
export interface KeystoreExportEntry extends KeystoreEntryDescriptor {
    /** Secret-bearing. This type is only returned after decrypting an encrypted export. */
    value: string;
}
export interface AddEntryInput {
    id: string;
    provider: string;
    envName: string;
    value: string;
    expiresAt?: number | null;
}
export interface KeystoreEntryDescriptor {
    id: CredentialId;
    provider: string;
    envName: string;
    fingerprint: string;
    addedAt: number;
    rotatedAt: number | null;
    expiresAt: number | null;
    revokedAt: number | null;
    disabled: boolean;
}
export interface KeystoreLookup {
    value: string;
    entryId: CredentialId;
    provider: string;
}
export interface KeystoreCandidateLookup extends KeystoreLookup {
    envName: string;
}
export declare class KeystoreEntryNotFoundError extends Error {
    constructor();
}
export declare class KeystoreEntryExistsError extends Error {
    constructor();
}
export declare class KeystoreValidationError extends Error {
    constructor(classification: "id" | "provider" | "envName" | "value" | "timestamp");
}
export declare class KeystoreWriteError extends Error {
    constructor(errno?: string);
}
export declare class KeystoreReadError extends Error {
    constructor(errno?: string);
}
export declare class KeystoreUnlockError extends Error {
    constructor();
}
export declare class KeystoreExportError extends Error {
    constructor(message?: string);
}
export declare class KeystoreMutationRefusedError extends Error {
    readonly status: "unreadable" | "degraded";
    readonly droppedCount: number;
    constructor(status: "unreadable" | "degraded", droppedCount?: number, errno?: string);
}
export declare function createKeystoreResolutionWalk(): KeystoreResolutionWalk;
/** Resolve the live store path without ever letting tests touch the user's real store. */
export declare function resolveKeystorePath(opts?: {
    path?: string;
}): string;
export declare function keyIsPresent(value: string | undefined): boolean;
export declare function lookupByEnvName(envName: string, opts?: KeystoreOptions, provider?: string): KeystoreLookup | null;
export declare function lookupByEnvName(envName: string, provider: string, opts?: KeystoreOptions): KeystoreLookup | null;
export declare function lookupByEnvNames(envNames: readonly string[], opts?: KeystoreOptions): KeystoreCandidateLookup | null;
export declare function listEntries(opts?: KeystoreOptions): KeystoreEntryDescriptor[];
/** Report resolver-readable custody state without throwing or exposing key material. */
export declare function keystoreStatus(opts?: KeystoreOptions): KeystoreStatus;
export declare function addEntry(input: AddEntryInput, opts?: KeystoreOptions): KeystoreEntryDescriptor;
/** Rotate installs a live replacement key; it deliberately un-revokes a revoked entry. */
export declare function rotateEntry(entryId: string, value: string, opts?: KeystoreOptions & {
    expiresAt?: number | null;
}): KeystoreEntryDescriptor;
export declare function revokeEntry(entryId: string, opts?: KeystoreOptions): KeystoreEntryDescriptor;
export declare function removeEntry(entryId: string, opts?: KeystoreOptions): boolean;
export declare function setDisabled(entryId: string, disabled: boolean, opts?: KeystoreOptions): KeystoreEntryDescriptor;
/** Read only the wrapping mode; passphrase bytes and KEK recovery are deliberately not involved. */
export declare function keystoreWrapMode(opts?: KeystoreOptions): KekWrapMode | null;
/**
 * Explicitly verify a passphrase store against its persisted KEK verifier.
 * Other wrap modes are a metadata-only no-op.
 */
export declare function verifyKeystoreUnlock(opts?: KeystoreOptions): KekWrapMode | null;
/** True only for this CLI's closed, versioned encrypted-export envelope. */
export declare function isEncryptedKeystoreExport(text: string): boolean;
/**
 * Decrypt every usable row and immediately re-encrypt the whole logical payload under an
 * export-time passphrase. A plaintext export API deliberately does not exist.
 */
export declare function createEncryptedKeystoreExport(exportPassphrase: string | Buffer, opts?: KeystoreOptions): string;
/** Decrypt an encrypted export for immediate insertion into another keystore. */
export declare function decryptEncryptedKeystoreExport(text: string, passphrase: string | Buffer): KeystoreExportEntry[];
/** Restore one authenticated export row, re-encrypting under the destination store's KEK. */
export declare function restoreEntryFromExport(input: KeystoreExportEntry, opts?: KeystoreOptions): KeystoreEntryDescriptor;
/** Zeroize a process-held KEK and end the matching unlock-failure cooldown epoch. */
export declare function lock(opts?: {
    path?: string;
}): void;
export {};