import type { ProbeObservation } from '../probe/registry.js';
import type { CredentialVault } from '../types/connector/index.js';
import type { SessionId, TenantId, TurnId } from '../types/ids/index.js';
import type { CredentialProvider } from './CredentialProvider.js';
export interface VaultInstrumentationOptions {
    /** Observation only — a vault wrapper records, it never refuses. */
    readonly probes?: ProbeObservation;
    /** The session whose lookups and changes this wrapper observes. */
    readonly sessionId?: SessionId;
    /** The turn whose lookups and changes this wrapper observes. */
    readonly turnId?: TurnId;
    readonly vaultId?: string;
    readonly tenantId?: TenantId;
}
export declare function wrapVaultWithProbes(vault: CredentialVault, opts?: VaultInstrumentationOptions): CredentialVault;
/**
 * Wrap a {@link CredentialProvider} so a change is observable.
 *
 * Through the SAME probe registry `vault_lookup` already uses. A second bus
 * would mean a subscriber that saw lookups and not rotations, or the other
 * way round, depending on which one it happened to find.
 *
 * `rotated` rather than `set` when a value was already there, and the
 * distinction is the one a reader actually wants: a first write is
 * configuration, a replacement is a credential turning over.
 */
export declare function wrapCredentialProviderWithProbes(provider: CredentialProvider, opts?: VaultInstrumentationOptions & {
    readonly source?: string;
}): CredentialProvider;
//# sourceMappingURL=instrumentation.d.ts.map