/**
 * vault-secrets — the deployed half of an agent's credentials, read and written
 * on the Sapiom CORE surface.
 *
 * Same auth contract as account-plan.ts and template-catalog.ts, and verified
 * there: core takes `Authorization: Bearer`, NOT the agents surface's
 * `x-sapiom-api-key`, and every path is prefixed `/v1`. The key is held
 * server-side and never reaches the browser.
 *
 * THE ASYMMETRY THIS MODULE EXISTS TO PRESERVE. `GET .../secrets` returns
 * `{ keys: string[] }` — names, never values. There is no read path for a
 * stored value anywhere in the platform, deliberately. So this client can tell
 * you a credential IS set and never what it is, and nothing downstream should
 * be built expecting otherwise.
 *
 * READS DEGRADE, WRITES DO NOT. A failed read returns null and the tab says it
 * could not list; a failed write throws {@link VaultSecretError} and the user
 * is told which key did not land. A write that fails quietly is the one
 * outcome this surface must never produce — the user would believe a
 * credential is in place and find out during a production run.
 */
import { type ApiKeyProvider } from "./api-key-provider.js";
/** A write that did not land, carrying enough to tell the user what to do. */
export declare class VaultSecretError extends Error {
    /** HTTP status, or 0 when the request never completed. */
    readonly status: number;
    constructor(message: string, 
    /** HTTP status, or 0 when the request never completed. */
    status: number);
}
export interface VaultSecretsClient {
    /**
     * The credential NAMES configured on this definition, sorted. `null` means
     * the list could not be read (signed out, unreachable, drifted shape) — which
     * is different from `[]`, an agent that genuinely has none, and the tab says
     * something different for each.
     */
    list(definitionId: string): Promise<string[] | null>;
    /** Writes one value, replacing any existing one under the same name. */
    set(definitionId: string, key: string, value: string): Promise<void>;
    /** Removes one name. */
    remove(definitionId: string, key: string): Promise<void>;
}
export declare function createVaultSecretsClient(opts: {
    /** Accepts a provider (preferred — enables refresh-on-401) or a bare key. */
    apiKey: string | null | ApiKeyProvider;
    /** Override the core base URL (resolved from env by default). Test seam. */
    baseUrl?: string;
    /** Injectable fetch. Test seam. */
    fetchImpl?: typeof fetch;
}): VaultSecretsClient;
//# sourceMappingURL=vault-secrets.d.ts.map