export interface KeyProvider {
    name: string;
    isAvailable(): boolean;
    getKey(id: string): Buffer | null;
    setKey(id: string, key: Buffer): boolean;
    deleteKey(id: string): boolean;
    healthCheck?(): {
        available: boolean;
        os: string;
        method: string;
        details: string;
    };
}
export type OSType = 'windows' | 'macos' | 'linux' | 'unknown';
export declare function detectOS(): OSType;
export declare function deriveMachineKey(): Buffer;
export declare function getKeyProvider(): KeyProvider;
/**
 * Get the canonical key provider for this machine.
 * Result is cached — same call always returns same provider.
 * Priority: OS-native > File-encrypted > Legacy
 */
export declare function getCanonicalProvider(): KeyProvider;
/**
 * Force re-selection of key provider (for testing or after OS changes)
 */
export declare function resetCanonicalProvider(): void;
/**
 * Get provider selection info (deterministic, cached)
 */
export declare function getCanonicalProviderInfo(): {
    provider: string;
    os: OSType;
    confidence: 'high' | 'medium' | 'low';
    reason: string;
};
export declare function getKey(id: string): Buffer | null;
export declare function setKey(id: string, key: Buffer): boolean;
export declare function deleteKey(id: string): boolean;
export declare function getOrCreateKey(id: string, keyLength?: number): Buffer;
export declare function getKeyProviderInfo(): {
    name: string;
    os: OSType;
    available: boolean;
};
export declare function getProviderHealthCheck(): {
    name: string;
    os: OSType;
    available: boolean;
    health?: {
        available: boolean;
        os: string;
        method: string;
        details: string;
    };
};
/**
 * Get key provider confidence level
 * High: OS-native provider available and working
 * Medium: File-based provider (weaker encryption)
 * Low: No provider available
 */
export declare function getKeyProviderConfidence(): {
    level: 'high' | 'medium' | 'low';
    reason: string;
};
//# sourceMappingURL=key-provider.d.ts.map