import { Credential, CredentialScope, CredentialStore } from './credentials.js';
import { ProviderKeys } from './keyed.js';
/**
 * The tenant scope of a user scope: the same tenant, no user. `undefined` for
 * a scope with no user or no tenant, so a user without a tenant never reads
 * the bucket shared by every scope with neither.
 */
export declare function tenantScopeOf({ userId, tenantId, }: CredentialScope): CredentialScope | undefined;
/**
 * The credential `id` of `scope`: the user's own first, then the tenant's
 * (saved without a `userId`). A save or a delete changes the user's own only.
 */
export declare function readCredential(store: CredentialStore, scope: CredentialScope, id: string): Promise<Credential | null>;
/**
 * Like {@link readCredential}, but also gives the scope where the credential
 * was found (`scope` itself, or its tenant scope) and its `revision` when the
 * store has `getVersioned`. Write a refreshed credential back to that scope,
 * with `setIf` and that revision.
 */
export declare function readCredentialEntry(store: CredentialStore, scope: CredentialScope, id: string): Promise<{
    credential: Credential;
    scope: CredentialScope;
    revision?: string;
} | null>;
/**
 * Provider keys saved on the server: the `api_key` credential stored under
 * the provider id for `scope` (the user's, else the tenant's), else the
 * provider's `env` names.
 *
 * @example
 * ```ts
 * const gpt = keyedAdapter(openaiByok, (key) =>
 *   createOpenaiChat('gpt-6.1-sol', key),
 * )
 * const keys = storedProviderKeys(credentials, { userId, tenantId })
 * chat({
 *   adapter: await keys.adapter(gpt),
 *   subagents: { agents, keys: keys.get },
 * })
 * ```
 */
export declare function storedProviderKeys(store: CredentialStore, scope: CredentialScope): ProviderKeys;