export class CredentialVault {
    secureStore;
    audit;
    constructor(secureStore, audit) {
        this.secureStore = secureStore;
        this.audit = audit;
    }
    async put(ref, secret) {
        await this.secureStore.set(ref, secret);
        const status = await this.secureStore.status(ref);
        this.audit.append({
            type: "credential.updated",
            severity: "warning",
            message: `Credential updated for ${ref.provider}/${ref.kind}.`,
            metadata: {
                provider: ref.provider,
                kind: ref.kind,
                accountId: ref.accountId,
            },
        });
        return status;
    }
    async resolve(ref) {
        const secret = await this.secureStore.get(ref);
        if (!secret) {
            throw new Error(`Credential missing for ${ref.provider}/${ref.kind}/${ref.accountId}.`);
        }
        return secret;
    }
    async status(ref) {
        return this.secureStore.status(ref);
    }
    async revoke(ref) {
        await this.secureStore.delete(ref);
        this.audit.append({
            type: "credential.revoked",
            severity: "warning",
            message: `Credential revoked for ${ref.provider}/${ref.kind}.`,
            metadata: {
                provider: ref.provider,
                kind: ref.kind,
                accountId: ref.accountId,
            },
        });
    }
}
