/**
 * Windows secret storage via Windows Credential Manager (wincred).
 *
 * Primary backend: the Credential Manager `advapi32` API (CredReadW /
 * CredWriteW / CredDeleteW / CredEnumerateW), reached through a static
 * PowerShell script that P/Invokes the C# shim below. PowerShell (Windows
 * PowerShell 5.1) ships with every supported Windows, so there is no separate
 * install step. Items are stored as CRED_TYPE_GENERIC with
 * CRED_PERSIST_LOCAL_MACHINE — device-local, matching the biometry-bound model
 * on macOS (src/lib/secrets/index.ts).
 *
 * Zero injection surface: the PS script is a single STATIC constant. All
 * dynamic data rides in the child ENV (target name, list prefix) or STDIN (the
 * secret value) — nothing is string-interpolated into the script. The child is
 * spawned with a spawnSync ARGV ARRAY (`-EncodedCommand <base64>`), never a
 * shell string.
 *
 * Headless fallback: when Credential Manager is unreachable (no logon session —
 * ERROR_NO_SUCH_LOGON_SESSION 1312 — or powershell.exe missing from PATH), we
 * transparently switch to the AES-256-GCM encrypted-file store in
 * ./filestore.ts, exactly like the Linux locked-collection fallback. The
 * decision is cached per process; one stderr line is emitted the first time.
 *
 * Item names are stored VERBATIM as the credential TargetName
 * (`agents-cli.bundles.<name>` / `agents-cli.secrets.<bundle>.<key>` — the
 * scheme shared with the file store, see ./filestore.ts) so `list` returns item
 * names directly.
 */
import type { KeychainBackend } from './index.js';
import { type NativeImportReport } from './fallback.js';
export { encryptForFallback, decryptForFallback, fileBackend, type EncFile, } from './filestore.js';
/**
 * CRED_MAX_CREDENTIAL_BLOB_SIZE — Credential Manager rejects a generic
 * credential blob larger than 2560 bytes with an opaque CredWrite failure. We
 * guard against it in `set` with a clear message. Only pathologically large
 * bundle metadata could hit this; such an item should live in a file-backed
 * bundle (AGENTS_SECRETS_PASSPHRASE) instead.
 */
export declare const CRED_MAX_CREDENTIAL_BLOB_SIZE = 2560;
/**
 * True when secret operations currently route to the encrypted-file store
 * instead of Windows Credential Manager. Mirrors linux.ts:usesFileFallback so
 * `listBundles()` doesn't double-count file-backed bundles under the fallback.
 */
export declare function usesFileFallback(): boolean;
export declare function hasCredManToken(item: string): boolean;
export declare function getCredManToken(item: string): string;
export declare function setCredManToken(item: string, value: string): void;
export declare function deleteCredManToken(item: string): boolean;
export declare function listCredManItems(prefix: string): string[];
/**
 * Parse the target names printed by the `list` op (one per line), keeping only
 * those starting with `prefix` and deduping. Same contract as
 * parseSecretToolItems (linux.ts). Exported for tests.
 */
export declare function parseWindowsCredList(output: string, prefix: string): string[];
/**
 * Copy agents-cli credentials from Credential Manager into the file store (the
 * `import-keyring` backend for Windows). Requires a reachable store; items
 * already in the file store are left untouched.
 */
export declare function importNativeCredManItems(prefix: string, commit: boolean): NativeImportReport;
/**
 * KeychainBackend implementation for Windows. Routes through Windows Credential
 * Manager (via PowerShell P/Invoke) with a transparent encrypted-file fallback
 * when the credential store is unreachable.
 */
export declare const windowsBackend: KeychainBackend;
/**
 * Test-only: reset module state so independent test cases don't bleed
 * availability / fallback decisions across each other. Pass `forceAvailable` to
 * pin the powershell-availability probe (skips the real spawn); pass `fileDir`
 * to redirect the encrypted-file store to a temp dir. File-store state lives in
 * ./filestore.ts and is reset there.
 */
export declare function _resetForTest(opts?: {
    fileDir?: string | null;
    forceFileFallback?: boolean;
    passphrase?: string | null;
    forceAvailable?: boolean | null;
}): void;
