/**
 * Default SecretStore — keychain-preferred, file-fallback implementation
 * used by the propagation pipeline.
 *
 * Resolution:
 *   1. OS keychain (via the SP4 keychain wrapper). When available, secrets
 *      live there and never touch the disk.
 *   2. Plain file fallback at `<dataDir>/keys/<key>` with mode 0o600 inside
 *      a 0o700 directory. Plain text (not encrypted): the threat model here
 *      is "casual disk reads by unprivileged co-users", which 0o600 already
 *      covers. The richer AES-256-GCM encryption lives in `src/security/`
 *      and is reserved for provider-specific resolution; this lower-tier
 *      store is intentionally minimal so the TUI can persist any future
 *      generic secret without coupling to provider semantics.
 *
 * The keychain account name is `wigolo-tui-<key>` and the user is `tui` so
 * stored entries don't collide with the per-provider entries managed by
 * `src/security/key-store.ts`.
 */
import type { SecretStore } from './propagation.js';
export interface DefaultSecretStoreOpts {
    dataDir: string;
}
export declare function defaultSecretStore(opts: DefaultSecretStoreOpts): SecretStore;
//# sourceMappingURL=secret-store.d.ts.map