import type { CredentialVault, GatewayPrincipal, ProviderSecret } from './CredentialVault';
import type { EncryptedCredentialSecret, KeyWrapper } from './KeyWrapper';
export declare const CREDENTIAL_SECRET_AAD_PURPOSE = "xpod.ai-gateway.credential-secret";
export declare const CREDENTIAL_SECRET_AAD_VERSION = "v1";
export interface CredentialVaultLogger {
    warn(message: string, metadata?: Record<string, unknown>): void;
}
export interface WebCryptoCredentialVaultOptions {
    keyWrapper: KeyWrapper;
    logger?: CredentialVaultLogger;
}
export declare class WebCryptoCredentialVault implements CredentialVault {
    private readonly keyWrapper;
    private readonly logger?;
    constructor(options: WebCryptoCredentialVaultOptions);
    seal(principal: GatewayPrincipal, credentialIri: string, provider: string, secret: ProviderSecret): Promise<EncryptedCredentialSecret>;
    open(principal: GatewayPrincipal, credentialIri: string, provider: string, encrypted: EncryptedCredentialSecret): Promise<ProviderSecret>;
    rewrap(principal: GatewayPrincipal, encrypted: EncryptedCredentialSecret): Promise<EncryptedCredentialSecret>;
    private createContext;
    private assertContext;
    private logOpenFailure;
    private logRewrapFailure;
}