import { type AiCredentialSecretDecoder } from '../../../ai/service/AiCredentialSecret';
import type { CredentialVault } from './CredentialVault';
export interface AiCredentialSecretDecoderOptions {
    /** Decodes wrapped (secret-cell / Cloud KMS) envelopes the Pod stores. */
    vault?: CredentialVault;
}
/**
 * Reads a Pod credential secret the way the Gateway does: plaintext payloads
 * first, then the configured credential vault. Embedding/indexing consumers use
 * this so an AI Connections credential behaves the same on both surfaces.
 */
export declare function createAiCredentialSecretDecoder(options?: AiCredentialSecretDecoderOptions): AiCredentialSecretDecoder;