import type Database from 'better-sqlite3-multiple-ciphers';
import type { BodyInspectionMode } from '../gate/body-inspector.js';
export type AuthType = 'bearer' | 'header' | 'query' | 'basic';
export interface Credential {
    id: string;
    name: string;
    service: string;
    authType: AuthType;
    headerName?: string;
    domains: string[];
    scopes: string[];
    expiresAt?: string;
    rateLimit?: string;
    bodyInspection: BodyInspectionMode;
    createdAt: string;
    updatedAt: string;
}
export interface CredentialWithSecret extends Credential {
    secret: string;
}
export declare class Vault {
    private db;
    /** Cached derived key — PBKDF2 runs once in the constructor. */
    private derivedKey;
    constructor(db: Database.Database, masterKey: string, salt?: Buffer | string);
    /**
     * Verify the master key by attempting to decrypt the first stored credential.
     * Throws a clear error if the key is wrong (AES-256-GCM auth tag mismatch).
     * Silently succeeds if the vault is empty (nothing to verify against).
     */
    private verifyKey;
    /**
     * Store a new credential in the vault.
     */
    /** Maximum credential secret size: 512 KB. */
    static readonly MAX_SECRET_BYTES: number;
    /** Maximum credential name length: 128 characters. */
    static readonly MAX_NAME_LENGTH = 128;
    add(params: {
        name: string;
        service: string;
        secret: string;
        authType?: AuthType;
        headerName?: string;
        domains: string[];
        scopes?: string[];
        ttlDays?: number;
        rateLimit?: string;
        bodyInspection?: BodyInspectionMode;
    }): Credential;
    /**
     * Rotate a credential's secret. The old secret is saved to credential_history
     * with an optional grace period during which it remains valid.
     */
    rotate(params: {
        name: string;
        newSecret: string;
        gracePeriodHours?: number;
    }): Credential;
    /**
     * Update a credential's metadata (domains, scopes, auth type, header name)
     * without re-entering the secret.
     */
    update(params: {
        name: string;
        domains?: string[];
        scopes?: string[];
        authType?: AuthType;
        headerName?: string;
        rateLimit?: string | null;
        bodyInspection?: BodyInspectionMode;
    }): Credential;
    /**
     * Check if a credential has expired based on its expiresAt field.
     */
    isExpired(credential: Credential): boolean;
    /**
     * List all credentials (without secrets).
     */
    list(): Credential[];
    /**
     * Get a credential by name, including the decrypted secret.
     */
    getByName(name: string): CredentialWithSecret | null;
    /**
     * Get a credential by service name, including the decrypted secret.
     */
    getByService(service: string): CredentialWithSecret | null;
    /**
     * Find a credential whose allowed domains match a given hostname.
     */
    findByDomain(hostname: string): CredentialWithSecret | null;
    /**
     * Remove a credential by name.
     */
    remove(name: string): boolean;
    /**
     * Check if a hostname matches any of the allowed domain patterns.
     * Supports wildcards: *.slack.com matches api.slack.com
     * Port-aware: if the stored domain includes a port (e.g. localhost:9999),
     * only that exact host:port matches. If no port is stored (e.g. api.stripe.com),
     * any port on that host matches.
     */
    domainMatches(hostname: string, allowedDomains: string[]): boolean;
    private rowToCredential;
}
//# sourceMappingURL=vault.d.ts.map