/**
 * Builder ("app") key resolution.
 *
 * Precedence: `VANA_APP_KEY` env (taken as given, never stored) ->
 * OS keychain (macOS `security`, service `org.vana.cli`) -> plaintext file
 * fallback `~/.vana/app-key.json` at 0600 (the one documented exception to
 * "the keychain holds anything that signs"; `doctor` flags it) -> generated
 * on first use when the caller allows it.
 *
 * The derived address is mirrored to the nonsecret `~/.vana/app-key.address`
 * so `whoami` and `doctor` can name the identity without touching the
 * secret store.
 */
import type { Address, Hex } from "viem";
export type AppKeySource = "env" | "keychain" | "file" | "generated";
export interface ResolvedAppKey {
    privateKey: Hex;
    address: Address;
    /** Uncompressed secp256k1 public key (0x04 + 128 hex). */
    publicKey: Hex;
    source: AppKeySource;
}
export declare class InvalidAppKeyError extends Error {
    constructor(where: string);
}
export declare class AppKeyMissingError extends Error {
    constructor();
}
/** Injectable keychain backend so tests never touch the real keychain. */
export interface KeychainBackend {
    get(): string | null;
    set(value: string): boolean;
}
/** Nonsecret pointer for display surfaces; null when no key has been used. */
export declare function readAppKeyPointer(): {
    address: Address;
    source: string;
} | null;
export interface ResolveAppKeyOptions {
    /** Generate and store a key when none exists. Default false. */
    allowGenerate?: boolean;
    env?: Record<string, string | undefined>;
    keychain?: KeychainBackend | null;
}
/**
 * Resolve the builder key, or throw {@link AppKeyMissingError} when none
 * exists and generation is not allowed.
 */
export declare function resolveAppKey(options?: ResolveAppKeyOptions): ResolvedAppKey;
//# sourceMappingURL=app-key.d.ts.map