/**
 * OpenMM Vault
 *
 * Encrypted credential storage using AES-256-GCM with PBKDF2 key derivation.
 * Same security model as x402 vault for consistency across QBT Labs projects.
 */
import type { VaultConfig, ExchangeId, ExchangeCredentials, WalletCredentials, SpendingPolicy } from './types.js';
/**
 * Securely wipe a buffer
 */
export declare function wipeBuffer(buffer: Buffer): void;
/**
 * OpenMM Vault - Encrypted credential storage
 */
export declare class Vault {
    private path;
    private iterations;
    private data;
    private derivedKey;
    /** Salt from the most recent key derivation; reused when re-encrypting on save. */
    private salt;
    constructor(config?: VaultConfig);
    /**
     * Check if vault exists
     */
    exists(): boolean;
    /**
     * Get vault file path
     */
    getPath(): string;
    /**
     * Initialize a new vault
     */
    init(password: string): Promise<void>;
    /**
     * Unlock an existing vault
     */
    unlock(password: string): Promise<void>;
    /**
     * Lock the vault (clear from memory)
     */
    lock(): void;
    /**
     * Check if vault is unlocked
     */
    isUnlocked(): boolean;
    /**
     * Add or update exchange credentials
     */
    setExchange(exchangeId: ExchangeId, credentials: ExchangeCredentials): Promise<void>;
    /**
     * Get exchange credentials
     */
    getExchange(exchangeId: ExchangeId): ExchangeCredentials | undefined;
    /**
     * Remove exchange credentials
     */
    removeExchange(exchangeId: ExchangeId): Promise<boolean>;
    /**
     * Set wallet credentials
     */
    setWallet(wallet: WalletCredentials): Promise<void>;
    /**
     * Get wallet credentials
     */
    getWallet(): WalletCredentials | undefined;
    /**
     * Remove wallet credentials
     */
    removeWallet(): Promise<boolean>;
    getPolicy(): SpendingPolicy | undefined;
    setPolicy(policy: SpendingPolicy): Promise<void>;
    resetPolicy(): Promise<void>;
    /**
     * List configured exchanges
     */
    listExchanges(): ExchangeId[];
    /**
     * Get all exchange credentials (use carefully!)
     */
    getAllExchanges(): Partial<Record<ExchangeId, ExchangeCredentials>>;
    /**
     * Get vault info (without sensitive data)
     */
    getInfo(): {
        version: number;
        name?: string;
        createdAt: string;
        updatedAt: string;
        exchanges: ExchangeId[];
        hasWallet: boolean;
        walletAddress?: string;
        walletChain?: string;
        hasPolicy: boolean;
        policy?: SpendingPolicy;
    };
    /**
     * Change vault password
     */
    changePassword(newPassword: string): Promise<void>;
    /**
     * Delete the vault file
     */
    destroy(): void;
    /**
     * Derive encryption key from password
     */
    private deriveKey;
    /**
     * Save vault to disk (encrypted)
     */
    private save;
    /**
     * Ensure vault is unlocked
     */
    private ensureUnlocked;
}
/**
 * Create and return a vault instance
 */
export declare function createVault(config?: VaultConfig): Vault;
//# sourceMappingURL=vault.d.ts.map