/**
 * api-key-store — Persist and retrieve the Amplitude project API key.
 *
 * Storage strategy (tried in order):
 *   1. Per-user cache file — `~/.amplitude/wizard/credentials.json`
 *      (see `credentials-file.ts` for the full why; mode `0o600`,
 *      keyed by hashed install dir, no OS keychain prompts).
 *   2. `.env.local` fallback — written to the project root and added
 *      to the project's `.gitignore` automatically. Used when (and
 *      only when) the per-user cache write fails (read-only home dir,
 *      EACCES on the cache root, etc.).
 *
 * Migration note for existing users: the previous implementation stored
 * keys in the macOS Keychain / Linux libsecret. Old entries are left in
 * place untouched (deleting them might re-prompt the user, the very
 * thing this refactor exists to eliminate). On the next launch the
 * standard credential resolution flow re-fetches the key from the
 * authenticated Amplitude API and writes it to the new cache file.
 * Net effect: a single silent "first launch after upgrade" with no
 * user-visible action required, and zero keychain prompts ever again.
 *
 * Why not the keychain? See the header of `credentials-file.ts` — short
 * version: the project API key is a public ingestion key shipped in
 * every client SDK bundle, so file-on-disk at `0o600` matches its true
 * sensitivity (same precedent as the OAuth tokens already living in
 * `~/.ampli.json`).
 */
/** @deprecated No-op since the keychain backend was removed. */
export declare function __setBinaryAvailableForTests(_name: string, _available: boolean | undefined): void;
/** @deprecated No-op since the keychain backend was removed. */
export declare function __resetHeadlessCacheForTests(): void;
/**
 * Source of a stored API key.
 *
 *   - `cache` — per-user `~/.amplitude/wizard/credentials.json`. The
 *     normal storage location; silent and shared across CLI invocations
 *     from the same install dir.
 *   - `env`   — project-local `.env.local`. Used only when the per-user
 *     cache write failed (read-only home, etc.) or when a previous
 *     wizard version persisted there.
 *
 * (Renamed from the legacy `'keychain'` value, which was a misnomer —
 * the wizard never actually stored anything in any OS keychain after
 * this refactor. Telemetry dashboards filtering on `'keychain'` should
 * be updated to `'cache'`.)
 */
export type ApiKeySource = 'cache' | 'env';
/**
 * Persist the Amplitude project API key for this project directory.
 * Tries the per-user cache file first, falls back to `.env.local`.
 */
export declare function persistApiKey(key: string, installDir: string): ApiKeySource;
/**
 * Remove the stored API key for this project directory from BOTH the
 * per-user cache AND `.env.local`. Has no effect if no key is stored.
 *
 * Cleared from every backend because `readApiKeyWithSource` falls
 * through them in order — leaving one populated would silently re-use
 * the previous login's key on the next run.
 *
 * NOTE: Old keychain / secret-tool entries from the pre-refactor
 * implementation are intentionally NOT cleared here. Calling
 * `security delete-generic-password` may still trigger a Keychain
 * Services unlock prompt on macOS, which defeats the whole point of
 * removing the keychain backend. Orphaned entries are harmless (nothing
 * reads them anymore) and users can clean them up via Keychain Access
 * if they want. Drop after one release.
 */
export declare function clearApiKey(installDir: string): void;
/**
 * Read a previously persisted API key for this project directory.
 * Returns null if not found in any storage.
 */
export declare function readApiKey(installDir: string): string | null;
/**
 * Read a previously persisted API key, also returning which storage was used.
 * Returns null if not found in any storage.
 */
export declare function readApiKeyWithSource(installDir: string): {
    key: string;
    source: ApiKeySource;
} | null;
