/**
 * The credential vault — holds API keys and tool credentials encrypted at rest.
 *
 * Like a cell's nucleus protecting DNA — credentials are only accessible
 * through the heart's execution methods. No public getter exists outside
 * the heart module. The credentials never leave the heart.
 */
import { type CryptoProvider } from "../core/crypto-provider.js";
export declare class CredentialVault {
    private readonly encryptionKey;
    private readonly credentials;
    private readonly provider;
    constructor(signingSecretKey: Uint8Array, provider?: CryptoProvider);
    /** Store a credential encrypted at rest. */
    store(name: string, value: string): void;
    /**
     * Retrieve a credential — only callable from within the heart module.
     * @internal
     */
    retrieve(name: string): string;
    /** Check if a credential exists. */
    has(name: string): boolean;
    /** List credential names (not values). */
    names(): string[];
    /**
     * Export the vault's encrypted contents for persistence.
     * The returned credentials are still encrypted with the key derived
     * from the signing secret key — they are safe to serialize.
     * @internal
     */
    exportEncrypted(): Array<{
        name: string;
        nonceB64: string;
        ciphertextB64: string;
    }>;
    /**
     * Restore vault contents from an exported set.
     * Assumes the vault was constructed with the same signing key that
     * originally encrypted these credentials.
     * @internal
     */
    importEncrypted(entries: Array<{
        name: string;
        nonceB64: string;
        ciphertextB64: string;
    }>): void;
    /** Securely wipe all credentials from memory. */
    destroy(): void;
}
//# sourceMappingURL=credential-vault.d.ts.map