import type { SecretVault } from '../types/secret-vault.js';
/**
 * Config-walking secret helpers, split out of secret-vault.ts so that
 * consumers which only need the walk logic (config loader, provider-config
 * watcher) don't pull the AES-GCM vault implementation — and its node:crypto
 * imports — into their bundle chunk. Everything here operates purely through
 * the `SecretVault` interface.
 */
/**
 * Walk a Config-shaped object and decrypt any apiKey-like fields in place,
 * returning a new object. Used by the config loader so the rest of the
 * system never has to know about the wire format.
 *
 * @param warn — callback for decryption warnings. Defaults to `console.warn`
 *   for backward compatibility; pass `logger.warn` when a structured logger
 *   is available (preferred in long-running/server contexts).
 */
export declare function decryptConfigSecrets<T>(cfg: T, vault: SecretVault, opts?: {
    warn?: (msg: string) => void;
}): T;
export declare function encryptConfigSecrets<T>(cfg: T, vault: SecretVault, _opts?: {
    warn?: (msg: string) => void;
}): T;
export declare function isSecretField(name: string): boolean;
//# sourceMappingURL=config-secrets.d.ts.map