/**
 * Secure Credentials Manager
 *
 * Handles API keys and credentials for external integrations (Jira, ADO, etc.)
 *
 * ARCHITECTURE (v0.34.0+):
 * - SECRETS (PAT, API_TOKEN, EMAIL) -> .env file (gitignored)
 * - CONFIG (domain, organization, project) -> config.json via ConfigManager
 *
 * This class loads secrets from .env and provides fallback to process.env
 * for backward compatibility. Config values should be loaded from ConfigManager
 * in calling code (reconcilers, importers, etc.)
 *
 * NOTE: For config values (domain, org, project), use ConfigManager directly.
 * Only use CredentialsManager for secrets (PAT, tokens, emails).
 */
/**
 * Canonical ADO PAT environment-variable aliases (0865 T-006).
 *
 * SINGLE SOURCE OF TRUTH for the ADO secret surface. Both the runtime resolver
 * (`integrations/ado/ado-pat-provider.getAdoPat`) and the health check
 * (`cli/commands/sync-health`) read through this table so health can never
 * report green while runtime writes throw "PAT not found".
 *
 * Order is precedence: AZURE_DEVOPS_PAT wins over AZURE_DEVOPS_TOKEN over ADO_PAT.
 * Org-specific PATs (`AZURE_DEVOPS_PAT_{ORG}`) take precedence over all of these
 * and are resolved by the caller before consulting this table.
 */
export declare const ADO_PAT_ALIASES: readonly ["AZURE_DEVOPS_PAT", "AZURE_DEVOPS_TOKEN", "ADO_PAT"];
/**
 * Resolve the ADO PAT from environment, honoring the org-specific override and
 * the canonical alias table. Returns `undefined` when none is set (callers
 * decide whether that is fatal). SECURITY: never logs the value.
 *
 * @param organization - Optional ADO organization for the `AZURE_DEVOPS_PAT_{ORG}` override
 */
export declare function resolveAdoPat(organization?: string): string | undefined;
export interface AdoCredentials {
    pat: string;
    organization: string;
    project: string;
    team?: string;
    teams?: string[];
}
export interface JiraCredentials {
    apiToken: string;
    email: string;
    domain: string;
    strategy?: 'project-per-team' | 'component-based' | 'board-based';
    project?: string;
    projects?: string[];
    components?: string[];
    boards?: string[];
}
export interface GitHubCredentials {
    token: string;
    strategy?: 'repository-per-team' | 'team-based' | 'team-multi-repo';
    owner?: string;
    repos?: string[];
    repo?: string;
    teams?: string[];
    teamRepoMapping?: Record<string, string[]>;
}
export interface CredentialsConfig {
    ado?: AdoCredentials;
    jira?: JiraCredentials;
    github?: GitHubCredentials;
}
export declare class CredentialsManager {
    private static instance;
    private credentials;
    private envLoaded;
    private constructor();
    /**
     * Parse comma-separated string into array of trimmed, non-empty strings
     */
    private parseCommaSeparated;
    static getInstance(): CredentialsManager;
    /**
     * Load credentials from .env file or environment variables
     */
    private loadFromEnv;
    /**
     * Parse .env file content into key-value pairs
     */
    private parseEnvFile;
    /**
     * Get ADO credentials
     *
     * NOTE (v0.34.0+): This method returns secrets from .env.
     * For config values (organization, project), use ConfigManager directly:
     *   const config = await configManager.read();
     *   const org = config.issueTracker?.organization_ado || '';
     *
     * @throws Error if credentials not found
     */
    getAdoCredentials(): AdoCredentials;
    /**
     * Get Jira credentials
     *
     * NOTE (v0.34.0+): This method returns secrets from .env.
     * For config values (domain), use ConfigManager directly:
     *   const config = await configManager.read();
     *   const domain = config.issueTracker?.domain || '';
     *
     * @throws Error if credentials not found
     */
    getJiraCredentials(): JiraCredentials;
    /**
     * Check if ADO credentials are available
     */
    hasAdoCredentials(): boolean;
    /**
     * Check if Jira credentials are available
     */
    hasJiraCredentials(): boolean;
    /**
     * Validate ADO credentials format
     */
    private validateAdoCredentials;
    /**
     * Validate Jira credentials format
     */
    private validateJiraCredentials;
    /**
     * Get masked version of credentials for logging (safe to display)
     */
    getMaskedAdoInfo(): string;
    /**
     * Get masked version of credentials for logging (safe to display)
     */
    getMaskedJiraInfo(): string;
    /**
     * Mask a secret for safe logging
     */
    private maskSecret;
    /**
     * Save credentials to .env file (with backup)
     */
    saveToEnvFile(config: Partial<CredentialsConfig>): void;
    /**
     * Ensure .env is in .gitignore
     */
    private ensureGitignore;
    /**
     * Create .env.example file for team
     */
    createEnvExample(): void;
}
export declare const credentialsManager: CredentialsManager;
//# sourceMappingURL=credentials-manager.d.ts.map