export declare const STACK_VAULT_HEADER = "STACKVAULT1";
export declare function isWrapped(contents: string): boolean;
/**
 * Encrypt a vault password (the plaintext string ansible-vault wants) with a
 * user-chosen passphrase. Returns the file contents to write to ~/.vault_pass.
 */
export declare function wrapPassword(plaintext: string, passphrase: string): Promise<string>;
/**
 * Decrypt a wrapped ~/.vault_pass and return the inner vault password.
 *
 * Throws on bad passphrase or tampered file (gcm tag fails) — caller is
 * expected to surface the error and re-prompt.
 */
export declare function unwrapPassword(fileContents: string, passphrase: string): Promise<string>;
//# sourceMappingURL=vault-key.d.ts.map