/**
 * Key-store: implements the keychain → encrypted-file → env fallback chain
 * for LLM provider API keys.
 *
 * Resolution order (highest to lowest):
 *   1. OS keychain (via @napi-rs/keyring) — preferred when available.
 *   2. Encrypted file (~/.wigolo/keys/<provider>.enc) — AES-256-GCM.
 *   3. Environment variable (e.g. ANTHROPIC_API_KEY) — read-only, never written here.
 *
 * IMPORTANT: resolveProviderKey NEVER writes to process.env. Secrets are
 * threaded explicitly to avoid leaking into child-process environments or logs.
 *
 * The machine-id used as KEK input is the data-dir path. This is a stable
 * machine-local value that changes when the user relocates their data dir,
 * which is acceptable — they would need to re-enter their key. The threat
 * model (documented in key-crypto.ts) is protection against casual disk reads
 * by unprivileged users, not against root attackers who can read both the
 * data-dir path and the encrypted file.
 */
import type { LLMProvider } from '../integrations/cloud/llm/types.js';
export interface KeyStoreOpts {
    dataDir: string;
}
export interface ReadKeyResult {
    value: string;
    location: 'keychain' | 'file' | 'env';
}
export interface ProviderEntry {
    provider: LLMProvider | 'custom';
    location: 'keychain' | 'file' | 'env';
}
export declare const PICKER_PROVIDERS: ReadonlyArray<LLMProvider | 'custom'>;
/** Test/maintenance hook: clear the entire resolve memo. */
export declare function clearKeyStoreMemo(): void;
/**
 * Store a provider API key securely.
 * Prefers keychain; falls back to encrypted file when keychain unavailable.
 * Never writes to process.env.
 */
export declare function storeKey(provider: LLMProvider, value: string, opts: KeyStoreOpts): Promise<{
    location: 'keychain' | 'file';
}>;
/**
 * Read a stored key. Returns the raw value and where it was found.
 * Returns null when neither keychain nor file has a key.
 * Does NOT fall through to env — resolveProviderKey does that.
 */
export declare function readKey(provider: LLMProvider, opts: KeyStoreOpts): Promise<ReadKeyResult | null>;
/**
 * Delete a stored key from whichever tier holds it.
 */
export declare function deleteKey(provider: LLMProvider, opts: KeyStoreOpts): Promise<void>;
/**
 * Full resolution chain: keychain → file → env.
 * Returns the raw key value or undefined if none configured.
 * NEVER mutates process.env.
 *
 * Memoization: only the EXPENSIVE keychain/file tier is memoized (a `string`
 * hit, or `null` for a verified keychain+file miss). The env tier is read
 * live on every call and never cached, so an env-var change is always picked
 * up and the value never goes stale. The memo collapses the repeated scrypt
 * decrypt / keychain probe that the synthesis hot path triggers (the
 * isLlmConfigured check + the runLlmText call), and is invalidated by
 * storeKey/deleteKey so a TUI re-keying takes effect immediately.
 */
export declare function resolveProviderKey(provider: LLMProvider, opts: KeyStoreOpts): Promise<string | undefined>;
/**
 * List all providers that have a stored key (keychain or file; env not included).
 */
export declare function listProviders(opts: KeyStoreOpts): Promise<ProviderEntry[]>;
//# sourceMappingURL=key-store.d.ts.map