export interface StoredProject {
    anon_key: string;
    service_key: string;
    site_url?: string;
    deployed_at?: string;
    last_deployment_id?: string;
    /**
     * The owning organization, cached so a returning machine can build addresses
     * that need it — the `run402::<org_id>/<project_id>` vault remote is the
     * first — WITHOUT a control-plane round trip.
     *
     * NOT a secret and NOT an authorization input: it is a routing identifier the
     * control plane hands out with every project listing, and nothing is granted
     * by holding it. Absent on entries written before this field existed, and on
     * any project this machine learned about without a listing; callers treat
     * absence as "ask the control plane", never as "no org".
     */
    org_id?: string;
    cached_at?: string;
    source?: string;
}
export interface KeyStore {
    version?: 1;
    source?: "local_cache";
    active_project_id?: string;
    previous_active_project_id?: string;
    projects: Record<string, StoredProject>;
    migrated_from?: string;
    migrated_at?: string;
}
/**
 * Load the project-key credential cache from disk.
 * Auto-imports legacy `projects.json` formats into the new cache path when using
 * the default location:
 * - Array format (CLI legacy): [{project_id, ...}] → {projects: {id: {...}}}
 * - Object format: {active_project_id, projects} → credentials cache + state.json
 * - Old metadata fields: tier/expires_at/lease_expires_at are stripped
 */
export declare function loadKeyStore(path?: string): KeyStore;
export declare function saveKeyStore(store: KeyStore, path?: string): void;
export declare function getProject(projectId: string, path?: string): StoredProject | undefined;
export declare function saveProject(projectId: string, project: StoredProject, path?: string): void;
export declare function updateProject(projectId: string, update: Partial<StoredProject>, path?: string): void;
export declare function removeProject(projectId: string, path?: string): void;
export declare function getActiveProjectId(path?: string): string | undefined;
export declare function setActiveProjectId(projectId: string, path?: string): void;
/**
 * Scoped the same way as the getter/setter above — a caller reaching for
 * `profile-state.ts`'s `clearActiveProjectId` directly (unscoped) clears only
 * the "unknown"-principal bucket, leaving a real wallet's own scoped entry
 * (set through `setActiveProjectId` above, or `NodeCredentialsProvider`)
 * untouched and still resolvable.
 */
export declare function clearActiveProjectId(projectId: string, path?: string): void;
//# sourceMappingURL=keystore.d.ts.map