/**
 * Local Vault for Gateway Type 3
 *
 * TWO-PART ARCHITECTURE:
 *
 * Part 1: Clear Text Configuration (.vault/config.json)
 * - Human-readable JSON
 * - Maps provider names to connection_id UUIDs
 * - Editable by users
 * - NOT encrypted
 *
 * Part 2: Encrypted Keystore (.vault/keystore.enc)
 * - AES-256-GCM encrypted credentials
 * - Base64-encoded for readability
 * - Header with DO NOT EDIT warnings
 * - Maps connection_id to API keys
 *
 * Key Features:
 * - Separation of configuration and secrets
 * - Clear warnings against manual keystore edits
 * - User-friendly configuration editing
 * - Secure credential storage
 */
export declare class LocalVault {
    private static instances;
    private vaultDir;
    private configPath;
    private keystorePath;
    private masterKey;
    private cache;
    private config;
    private algorithm;
    private userId?;
    constructor(config: {
        vaultPath?: string;
        masterPassword?: string;
        userId?: string;
    });
    /**
     * Get singleton instance for a specific user
     * Uses ~/.langmart/users/<userId> as vault directory for user-specific storage
     *
     * @param userId - User ID (optional for backward compatibility)
     */
    static getInstance(userId?: string): LocalVault;
    /**
     * Reset singleton instance (for testing)
     */
    static resetInstance(userId?: string): void;
    /**
     * Reset all singleton instances (for testing)
     */
    static resetAllInstances(): void;
    /**
     * Get the user ID associated with this vault
     */
    getUserId(): string | undefined;
    /**
     * Get the vault directory path
     */
    getVaultPath(): string;
    /**
     * Check if legacy vault exists (data in ~/.langmart/ instead of ~/.langmart/users/<userId>/)
     */
    static hasLegacyVault(): boolean;
    /**
     * Migrate legacy vault data to user-specific vault
     * Call this after validating the API key to get the user ID
     *
     * @param userId - User ID to migrate data to
     * @returns true if migration was successful, false if no legacy data found
     */
    static migrateLegacyVault(userId: string): Promise<boolean>;
    /**
     * Store API key for an access point
     * @param accessPointId - UUID of the access point
     * @param apiKey - Provider API key
     * @param provider - Optional provider name for config mapping
     * @param description - Optional description for config
     */
    setCredential(accessPointId: string, apiKey: string, provider?: string, description?: string): Promise<void>;
    /**
     * Get API key for an access point
     * @param accessPointId - UUID of the access point
     */
    getCredential(accessPointId: string): string | undefined;
    /**
     * Check if access point has credential
     * @param accessPointId - UUID of the access point
     */
    hasCredential(accessPointId: string): boolean;
    /**
     * List all access point IDs with credentials
     */
    listAccessPoints(): string[];
    /**
     * Remove credential for an access point
     * @param accessPointId - UUID of the access point
     */
    removeCredential(accessPointId: string): Promise<void>;
    /**
     * Clear all credentials
     */
    clearAll(): Promise<void>;
    /**
     * Store gateway authentication API key
     * Special key stored with reserved ID '__gateway_auth__'
     */
    setAuthKey(apiKey: string): Promise<void>;
    /**
     * Get gateway authentication API key
     */
    getAuthKey(): string | undefined;
    /**
     * Check if gateway authentication key is stored
     */
    hasAuthKey(): boolean;
    /**
     * Remove gateway authentication key (logout)
     */
    removeAuthKey(): Promise<void>;
    /**
     * Load clear text configuration
     */
    private loadConfig;
    /**
     * Save clear text configuration
     */
    private saveConfig;
    /**
     * Load encrypted keystore
     */
    private loadKeystore;
    /**
     * Save encrypted keystore with header warnings
     */
    private saveKeystore;
    /**
     * Encrypt data using AES-256-GCM
     */
    private encrypt;
    /**
     * Decrypt data using AES-256-GCM
     */
    private decrypt;
    /**
     * Initialize vault with credentials from environment variables
     * NOTE: This is for backward compatibility only
     * In production, use connection_id as key, not provider names
     * Example: vault.setCredential('uuid-of-connection', 'sk-...')
     */
    initializeFromEnvironment(): Promise<void>;
    /**
     * Export credentials (for backup - USE WITH CAUTION)
     * Returns map of connection_id -> apiKey
     */
    export(): {
        [accessPointId: string]: string;
    };
    /**
     * Import credentials (for restore)
     * @param credentials - Map of connection_id -> apiKey
     */
    import(credentials: {
        [accessPointId: string]: string;
    }): Promise<void>;
}
/**
 * Usage Example (PRODUCTION):
 *
 * const vault = new LocalVault({
 *     vaultPath: './.vault',
 *     masterPassword: 'my-secure-password'
 * });
 *
 * // Store credential using connection_id (from database) with provider mapping
 * await vault.setCredential(
 *     '12345678-1234-1234-1234-123456789abc',  // connection_id
 *     'sk-...',                                  // API key
 *     'groq',                                    // provider name (optional, for config)
 *     'Groq production endpoint'                 // description (optional)
 * );
 *
 * // Retrieve credential using connection_id
 * const apiKey = vault.getCredential('12345678-1234-1234-1234-123456789abc');
 *
 * // Check available access points
 * const accessPoints = vault.listAccessPoints();
 * debugLog('Stored credentials for:', accessPoints);
 *
 * // Files created:
 * // .vault/config.json - Clear text, editable, maps provider names to UUIDs
 * // .vault/keystore.enc - Encrypted, base64-encoded, with DO NOT EDIT warnings
 */ 
//# sourceMappingURL=local-vault.d.ts.map