/**
 * OS-native secret storage.
 *
 * macOS: Keychain via `security` CLI (always available).
 * Windows: Credential Manager via PowerShell + advapi32 P/Invoke (always available, no extra modules).
 *
 * Secrets are stored as JSON payloads keyed by connection name.
 *
 * Imports: none from internal layers. Pure shell-out utility.
 */
/** Store a secret payload for a connection. Overwrites if exists. */
export declare function setSecret(name: string, payload: Record<string, string>): void;
/** Retrieve a secret payload for a connection. Returns undefined if not found. */
export declare function getSecret(name: string): Record<string, string> | undefined;
/** Remove a secret for a connection. Returns true if it existed. */
export declare function removeSecret(name: string): boolean;
/** Store a JSON payload in the OS keychain under a custom service namespace. */
export declare function setNamespacedSecret(service: string, name: string, payload: object): void;
/** Retrieve a JSON payload from the OS keychain for a custom service namespace. */
export declare function getNamespacedSecret<T extends object>(service: string, name: string): T | undefined;
/** Remove a JSON payload from the OS keychain for a custom service namespace. */
export declare function removeNamespacedSecret(service: string, name: string): boolean;
/**
 * Build environment variables for a set of connections.
 * Returns a Record to merge into a subprocess's env.
 *
 * Field names are used as-is for env var keys — name your fields to match
 * what the target tool expects (e.g. GITHUB_TOKEN, DATABASE_URL).
 */
export declare function buildConnectionEnv(connectionNames: string[]): Record<string, string>;
export declare function validateConnectionName(name: string): string | undefined;
export declare function validateFieldName(name: string): string | undefined;
//# sourceMappingURL=secret-store.d.ts.map