import { commandExistsOnPath } from "./executable-lookup.js";
export type KekWrapMode = "dpapi" | "keychain" | "libsecret" | "passphrase";
export type OsKekWrapMode = Exclude<KekWrapMode, "passphrase">;
export interface ScryptKdfDescriptor {
    n: 16384;
    r: 8;
    p: 1;
    salt: string;
}
/** Shape persisted as the keystore's `kek` block. */
export interface KekDescriptor {
    wrap: KekWrapMode;
    /** Present only for DPAPI. */
    blob?: string;
    /** Present only for passphrase mode. */
    kdf?: ScryptKdfDescriptor;
}
export interface KeyringSpawnSyncOptions {
    windowsHide: true;
    stdio: "pipe";
    encoding: "buffer";
    input?: Buffer;
}
export interface KeyringSpawnSyncResult {
    status: number | null;
    stdout?: Buffer | Uint8Array | string | null;
    stderr?: Buffer | Uint8Array | string | null;
    error?: Error | undefined;
}
/** Captured-stdio synchronous spawn seam; no child error object may escape its caller. */
export type KeyringSpawnSync = (command: string, args: string[], options: KeyringSpawnSyncOptions) => KeyringSpawnSyncResult;
export type KeyringCommandExists = (command: string, env: NodeJS.ProcessEnv) => boolean;
export type KeyringRandomBytes = (size: number) => Buffer;
export interface KeyringOptions {
    mode?: KekWrapMode;
    platform?: NodeJS.Platform;
    env?: NodeJS.ProcessEnv;
    /** Caller-owned; this module never mutates or zeroizes it. */
    passphrase?: string | Buffer;
    spawnSync?: KeyringSpawnSync;
    commandExists?: KeyringCommandExists;
    randomBytes?: KeyringRandomBytes;
    /** Non-secret stable identifier for one keystore's OS-held item. */
    keyId?: string;
}
export interface WrapKekOptions extends Omit<KeyringOptions, "mode" | "passphrase"> {
    mode?: OsKekWrapMode;
}
export declare class KeyringUnavailableError extends Error {
    constructor();
}
export declare class KeyringPassphraseRequiredError extends Error {
    constructor();
}
/** Resolve Windows PowerShell 5.1 without consulting PATH. */
export declare function windowsPowerShellPath(env?: NodeJS.ProcessEnv): string;
/** Pure argv builders. Secret material is deliberately not accepted as an argument. */
export declare function dpapiWrapArgv(): string[];
export declare function dpapiUnwrapArgv(): string[];
export declare function keychainStoreArgv(): string[];
export declare function keychainLoadArgv(keyId?: string): string[];
export declare function libsecretStoreArgv(keyId?: string): string[];
export declare function libsecretLoadArgv(keyId?: string): string[];
/**
 * PATH lookup used only to select Linux libsecret versus passphrase mode; it never spawns.
 *
 * ⚠ The implementation moved to `executable-lookup.ts` when `installed-hosts.ts` needed the same
 * question answered — two PATH walks would be the second implementation this project forbids, and
 * the copy here had no PATHEXT handling. Behaviour on Linux, the only platform this caller runs
 * on, is unchanged. Re-exported rather than relocated at the call sites so this module's public
 * surface stays what it was.
 */
export { commandExistsOnPath };
/**
 * Wrap/store an existing random KEK in an OS facility.
 *
 * Passphrase mode is intentionally absent: its exact v1 format has only KDF parameters and no
 * encrypted blob, so `createPassphraseKek` derives the KEK instead of pretending to wrap one.
 */
export declare function wrapKek(kek: Buffer, options?: WrapKekOptions): KekDescriptor;
/** Derive one 256-bit KEK without changing caller-owned passphrase bytes. */
export declare function derivePassphraseKek(passphrase: string | Buffer, kdf: ScryptKdfDescriptor): Buffer;
export declare function createPassphraseKek(passphrase: string | Buffer, options?: {
    randomBytes?: KeyringRandomBytes;
}): {
    kek: Buffer;
    descriptor: KekDescriptor;
};
/** Create a KEK using the selected platform custody mechanism. */
export declare function createKek(options?: KeyringOptions): {
    kek: Buffer;
    descriptor: KekDescriptor;
};
/** Lazily recover a KEK. The returned Buffer is owned by the caller. */
export declare function unwrapKek(descriptor: KekDescriptor, options?: KeyringOptions): Buffer;
/** Constant-time helper for tests and callers that verify a passphrase-derived round trip. */
export declare function sameKek(left: Buffer, right: Buffer): boolean;