import type { CredentialVault, GatewayPrincipal, ProviderSecret } from './CredentialVault';
import type { EncryptedCredentialSecret } from './KeyWrapper';
/**
 * Stores the user-owned provider configuration as plain JSON in the Pod.
 *
 * The record shape remains compatible with the existing credential schema so
 * encrypted records can coexist during migration, but no encryption or
 * deployment root key is involved.
 */
export declare class PlaintextCredentialVault implements CredentialVault {
    private readonly legacyVault?;
    constructor(options?: {
        legacyVault?: CredentialVault;
    });
    seal(principal: GatewayPrincipal, credentialIri: string, provider: string, secret: ProviderSecret): Promise<EncryptedCredentialSecret>;
    open(principal: GatewayPrincipal, credentialIri: string, provider: string, stored: EncryptedCredentialSecret): Promise<ProviderSecret>;
    rewrap(principal: GatewayPrincipal, stored: EncryptedCredentialSecret): Promise<EncryptedCredentialSecret>;
    needsRewrap(stored: EncryptedCredentialSecret): boolean;
}