/**
 * CredentialStore — short-lived, per-host credential handles.
 *
 * Handles live in memory only. Each has:
 *   - a unique id (e.g. "cred_3")
 *   - the host it is bound to (the password will ONLY be typed on this host)
 *   - the actual value (set once, never logged, never serialized)
 *   - an expiry timestamp (auto-wipe after TTL)
 *
 * The LLM / planner only ever sees the handle id — never the value.
 */
export interface CredentialHandle {
    readonly id: string;
    readonly host: string;
    readonly account?: string;
    readonly createdAt: number;
    readonly expiresAt: number;
}
export declare class CredentialStore {
    private readonly ttlMs;
    private creds;
    private nextId;
    private sweeper;
    constructor(ttlMs?: number);
    /** Store a credential bound to a host. Returns a safe handle. */
    put(host: string, value: string, account?: string): CredentialHandle;
    /** Look up a credential handle (no value). */
    get(id: string): CredentialHandle | undefined;
    /**
     * Resolve the actual value — the ONLY way to get it.
     * Caller must pass the current host; mismatch => null (and handle is wiped).
     */
    resolve(id: string, currentHost: string): string | null;
    /** Find an unexpired handle bound to this host (most recent wins). */
    findForHost(currentHost: string): CredentialHandle | undefined;
    forget(id: string): void;
    clear(): void;
    listPublic(): CredentialHandle[];
    dispose(): void;
    private publicView;
    private hostMatches;
    private sweep;
}
//# sourceMappingURL=credential-store.d.ts.map