/**
 * Secure Credential Manager
 *
 * Provides secure storage and retrieval of API keys and other sensitive credentials.
 * Uses encryption when storing to disk and prioritizes environment variables.
 *
 * Security hierarchy (in order of preference):
 * 1. Environment variables (most secure - no disk storage)
 * 2. Encrypted storage with machine-specific key
 * 3. Plain-text storage (with warning)
 */
import { EventEmitter } from 'events';
export interface CredentialConfig {
    /** Enable encryption for stored credentials (default: true) */
    encryptionEnabled: boolean;
    /** Path to credentials file (default: ~/.codebuddy/credentials.enc) */
    credentialsPath?: string;
    /** Warn about plain-text storage (default: true) */
    warnPlainText: boolean;
}
export interface StoredCredentials {
    apiKey?: string;
    claudeApiKey?: string;
    openaiApiKey?: string;
    geminiApiKey?: string;
    [key: string]: string | undefined;
}
export declare class CredentialManager extends EventEmitter {
    private static instance;
    private config;
    private credentialsPath;
    private cachedCredentials;
    private constructor();
    /**
     * Get singleton instance
     */
    static getInstance(config?: Partial<CredentialConfig>): CredentialManager;
    /**
     * Reset singleton instance (for testing)
     */
    static resetInstance(): void;
    /**
     * Get a credential by key
     * Priority: environment variable > encrypted storage > plain text storage
     */
    getCredential(key: keyof StoredCredentials): string | undefined;
    /**
     * Set a credential
     * Stores encrypted if encryption is enabled
     */
    setCredential(key: keyof StoredCredentials, value: string): void;
    /**
     * Delete a credential
     */
    deleteCredential(key: keyof StoredCredentials): void;
    /**
     * Check if a credential exists (in env or storage)
     */
    hasCredential(key: keyof StoredCredentials): boolean;
    /**
     * List all available credential keys
     */
    listCredentialKeys(): string[];
    /**
     * Get the API key (convenience method)
     * Checks GROK_API_KEY, XAI_API_KEY, then stored credentials
     */
    getApiKey(): string | undefined;
    /**
     * Set the API key (convenience method)
     */
    setApiKey(apiKey: string): void;
    /**
     * Check if credentials are stored encrypted
     */
    isEncryptionEnabled(): boolean;
    /**
     * Get security status for display
     */
    getSecurityStatus(): {
        encryptionEnabled: boolean;
        storagePath: string;
        credentialCount: number;
        envCredentialCount: number;
    };
    /**
     * Load credentials from storage
     */
    private loadCredentials;
    /**
     * Save credentials to storage
     */
    private saveCredentials;
    /**
     * Clear cached credentials (useful after modifications)
     */
    clearCache(): void;
    /**
     * Migrate from legacy plain-text storage to encrypted
     */
    migrateToEncrypted(): boolean;
}
/**
 * Get the singleton credential manager instance
 */
export declare function getCredentialManager(config?: Partial<CredentialConfig>): CredentialManager;
/**
 * Get the API key from environment or secure storage
 */
export declare function getApiKey(): string | undefined;
/**
 * Set the API key in secure storage
 */
export declare function setApiKey(apiKey: string): void;
