import type { HttpClient } from "../core/http.js";
import type { CreateVaultRequest, EnableCmekRequest, EnableMpcRequest, CmekRotationJobResponse, VaultResponse, VaultListResponse, OneclawResponse } from "../types.js";
/**
 * Vault resource — create, list, get, and delete encrypted vaults.
 */
export declare class VaultResource {
    private readonly http;
    constructor(http: HttpClient);
    /** Create a new vault. Optionally pass `mpc_custody` to enable MPC at creation time. */
    create(options: CreateVaultRequest): Promise<OneclawResponse<VaultResponse>>;
    /** Fetch a single vault by ID. */
    get(vaultId: string): Promise<OneclawResponse<VaultResponse>>;
    /** List all vaults visible to the authenticated identity. */
    list(): Promise<OneclawResponse<VaultListResponse>>;
    /** Permanently delete a vault and all its secrets. */
    delete(vaultId: string): Promise<OneclawResponse<void>>;
    /** Enable CMEK on a vault (Business/Enterprise only). */
    enableCmek(vaultId: string, request: EnableCmekRequest): Promise<OneclawResponse<VaultResponse>>;
    /** Disable CMEK on a vault. Secrets remain encrypted but no new CMEK layer is applied. */
    disableCmek(vaultId: string): Promise<OneclawResponse<VaultResponse>>;
    /** Enable MPC on a vault (Business/Enterprise only). */
    enableMpc(vaultId: string, request: EnableMpcRequest): Promise<OneclawResponse<VaultResponse>>;
    /**
     * Start a server-assisted CMEK key rotation job.
     * Both keys are sent in headers (transit over TLS only) and are not logged.
     */
    rotateCmek(vaultId: string, oldKeyBase64: string, newKeyBase64: string, newFingerprint: string): Promise<OneclawResponse<CmekRotationJobResponse>>;
    /** Poll the status of a CMEK rotation job. */
    getRotationJobStatus(vaultId: string, jobId: string): Promise<OneclawResponse<CmekRotationJobResponse>>;
}
//# sourceMappingURL=vault.d.ts.map