/**
 * OS keychain abstraction for credential storage.
 *
 * Uses `@napi-rs/keyring` (optional dependency) to store credentials in:
 * - Windows: Credential Manager (pre-built binaries, no compilation needed)
 * - macOS: Keychain
 * - Linux: libsecret / GNOME Keyring
 *
 * If @napi-rs/keyring is not installed or the OS keychain is unavailable
 * (headless server, no GUI), all functions gracefully return null/false and
 * the caller falls back to config-file storage.
 */
import type { ServerConfig } from "../config/schema.js";
interface EntryClass {
    new (service: string, account: string): {
        getPassword(): string | null;
        setPassword(password: string): void;
        deletePassword(): boolean;
    };
}
interface KeyringModule {
    Entry: EntryClass;
}
/**
 * Test hook — reset the cached keyring module so `vi.mock` re-runs resolve
 * with a fresh factory between cases. Production code never calls this.
 */
export declare function __resetKeyringCacheForTests(): void;
/**
 * Test hook — inject a stub `Entry` backend so the positive-path tests
 * (TEST-005 in Batch 7) can exercise save/load/migrate without `@napi-rs/
 * keyring` actually being installed and without relying on `vi.mock`
 * intercepting the `new Function("specifier","return import(specifier)")`
 * dynamic load. Pass `null` to clear and fall back to the real dynamic
 * import. Production code never calls this.
 */
export declare function __setKeyringForTests(stub: KeyringModule | null): void;
/**
 * Check if the OS keychain is available.
 * Returns false if @napi-rs/keyring is not installed or the keychain daemon
 * is not running.
 */
export declare function isKeychainAvailable(): Promise<boolean>;
/**
 * Load credentials from the OS keychain.
 * Returns null if keychain is unavailable or credentials are not stored.
 */
export declare function loadCredentials(): Promise<{
    password: string;
    smtpToken: string;
} | null>;
/**
 * Save credentials to the OS keychain.
 * Returns true on success, false if keychain is unavailable.
 */
export declare function saveCredentials(password: string, smtpToken: string): Promise<boolean>;
/**
 * Delete credentials from the OS keychain.
 * Returns true on success, false if keychain is unavailable.
 */
export declare function deleteCredentials(): Promise<boolean>;
/**
 * Load the password / smtp-token stored in the keychain for a
 * specific account. Returns null when the keychain is unavailable or
 * when neither value is set for that account — callers can treat
 * those two cases the same (blank credentials).
 */
export declare function loadAccountCredentials(accountId: string): Promise<{
    password: string;
    smtpToken: string;
} | null>;
/**
 * Save an account's password / smtp-token into the keychain. Empty
 * strings are silently skipped (the keychain entry keeps whatever
 * value it had before) — this lets the Accounts UI send back
 * "•••••••" as a placeholder when the user didn't change the field
 * without blowing away the real value. Returns true on any success
 * (at least one value stored), false if the keychain is unavailable
 * or both inputs are empty.
 */
export declare function saveAccountCredentials(accountId: string, password: string, smtpToken: string): Promise<boolean>;
/**
 * Remove an account's keychain entries. Called when an account is
 * deleted via the Accounts tab — leaving stranded keychain entries
 * would accumulate cruft and leak old passwords on next `backup-
 * keychain` run.
 */
export declare function deleteAccountCredentials(accountId: string): Promise<boolean>;
/**
 * Migrate plaintext credentials from config file to OS keychain.
 * Idempotent — safe to call multiple times.
 *
 * Returns true if migration occurred, false if skipped or failed.
 */
export declare function migrateFromConfig(config: ServerConfig, saveConfigFn: (config: ServerConfig) => void): Promise<boolean>;
/**
 * Load Pass PAT + SimpleLogin API key from the keychain (CRED-001).
 * Returns null if neither secret is present or keychain is unavailable.
 */
export declare function loadAuxiliaryCredentials(): Promise<{
    passAccessToken: string;
    simpleloginApiKey: string;
} | null>;
/** Save Pass PAT + SimpleLogin API key to the keychain. */
export declare function saveAuxiliaryCredentials(passAccessToken: string, simpleloginApiKey: string): Promise<boolean>;
/** Load remoteBearerToken + remoteOauthAdminPassword from the keychain. */
export declare function loadRemoteSecrets(): Promise<{
    remoteBearerToken: string;
    remoteOauthAdminPassword: string;
} | null>;
/** Save remoteBearerToken + remoteOauthAdminPassword to the keychain. */
export declare function saveRemoteSecrets(remoteBearerToken: string, remoteOauthAdminPassword: string): Promise<boolean>;
export {};
//# sourceMappingURL=keychain.d.ts.map