import type { CredentialBundle, Region } from "../types.js";
import { type CredentialConfigurationDescriptor, type CredentialProvider, type CredentialSourceState, type EnvCredentialProviderOptions } from "./credentials.js";
/** The service name used for all Pi LeetCode credentials in the OS keyring. */
export declare const DEFAULT_CREDENTIAL_STORE_SERVICE = "pi-leetcode-tools";
export interface StoredCredentialInput {
    session: string;
    csrfToken?: string;
    verifiedAt?: string;
    expiresAt?: string;
}
export interface StoredCredentialRegionMetadata {
    operationReady: boolean;
    verifiedAt?: string;
    expiresAt?: string;
}
export interface StoredCredentialProfile {
    profileId: string;
    regions: Readonly<Partial<Record<Region, StoredCredentialRegionMetadata>>>;
}
export interface CredentialReplaceOptions {
    activate?: boolean;
}
export interface CredentialStore {
    get(profileId: string, region: Region): CredentialBundle | undefined;
    set(profileId: string, region: Region, credentials: StoredCredentialInput): void;
    replace(profileId: string, region: Region, credentials: StoredCredentialInput, options?: CredentialReplaceOptions): void;
    delete(profileId: string, region: Region): boolean;
    has(profileId: string, region: Region): boolean;
    listProfiles(): readonly StoredCredentialProfile[];
    getActiveProfileId(): string | undefined;
    setActiveProfileId(profileId: string): void;
    clearActiveProfileId(): void;
    /** Safe, opaque mutation epoch. It contains no credential-derived material. */
    getEpoch(): string;
}
export interface KeyringEntry {
    getPassword(): string | null;
    setPassword(password: string): void;
    deletePassword(): boolean;
}
export interface OsKeyringCredentialStoreOptions {
    /** Test seam; production callers should use the native Entry implementation. */
    entryFactory?: (service: string, account: string) => KeyringEntry;
    revisionFactory?: () => string;
}
export declare function validateStoredCredentialInput(credentials: StoredCredentialInput): Required<Pick<StoredCredentialInput, "session" | "csrfToken">> & Pick<StoredCredentialInput, "verifiedAt" | "expiresAt">;
export declare class OsKeyringCredentialStore implements CredentialStore {
    #private;
    constructor(options?: OsKeyringCredentialStoreOptions);
    get(profileId: string, region: Region): CredentialBundle | undefined;
    set(profileId: string, region: Region, credentials: StoredCredentialInput): void;
    replace(profileId: string, region: Region, credentials: StoredCredentialInput, options?: CredentialReplaceOptions): void;
    delete(profileId: string, region: Region): boolean;
    has(profileId: string, region: Region): boolean;
    listProfiles(): readonly StoredCredentialProfile[];
    getActiveProfileId(): string | undefined;
    setActiveProfileId(profileId: string): void;
    clearActiveProfileId(): void;
    getEpoch(): string;
}
export declare function createDefaultCredentialStore(): CredentialStore;
export interface StoredCredentialProviderOptions {
    store?: CredentialStore;
    profileId?: string;
    resolveProfileId?: () => string;
}
export declare class StoredCredentialProvider implements CredentialProvider {
    #private;
    constructor(options?: StoredCredentialProviderOptions);
    get profileId(): string;
    getCredentials(region: Region): Promise<CredentialBundle | undefined>;
    getSourceState(region: Region): CredentialSourceState;
    isConfigured(region: Region, requirement?: "session" | "operation"): boolean;
    getActiveProfileId(): string | undefined;
    getRevision(): number;
    getConfiguration(): Promise<CredentialConfigurationDescriptor>;
}
export interface CompositeCredentialProviderOptions {
    providers: readonly CredentialProvider[];
}
export declare class CompositeCredentialProvider implements CredentialProvider {
    #private;
    constructor(options: CompositeCredentialProviderOptions | readonly CredentialProvider[]);
    getCredentials(region: Region): Promise<CredentialBundle | undefined>;
    getSourceState(region: Region): CredentialSourceState;
    isConfigured(region: Region, requirement?: "session" | "operation"): boolean;
    getActiveProfileId(): string | undefined;
    getRevision(): number;
    getConfiguration(): Promise<CredentialConfigurationDescriptor>;
}
export interface DefaultCredentialProviderOptions {
    env?: EnvCredentialProviderOptions;
    store?: CredentialStore;
}
export declare function createDefaultCredentialProvider(options?: DefaultCredentialProviderOptions): CredentialProvider;
//# sourceMappingURL=stored-credentials.d.ts.map