/**
 * Credential Vault (spec D29, IT-7) — owner-scoped, encrypted-at-rest storage for workflow
 * node credentials (http auth headers, oauth tokens, …).
 *
 * Storage layout (under the active owner profile, sibling of settings):
 *   <ownerProfile>/credentials/.vault-key      random 32-byte key, created once (0600)
 *   <ownerProfile>/credentials/<id>.json       AES-256-GCM ciphertext envelope
 *
 * Threat model: the key and the data live in separate files on the SAME machine — this protects
 * against credential files leaking individually (backups, copy-paste, bundle export), not against
 * an attacker with full user-account access (no user master password exists to anchor more).
 *
 * Hard rules (D29): decrypted secrets exist only inside the engine process at execution time —
 * list() never returns secret material, and nothing here is ever serialized into defs, bundles,
 * exports, or Hub publishes (the bundle sanitizer strips by key shape as the second fence).
 */
export type CredentialType = "apiKey" | "bearer" | "basic" | "oauth2" | "custom";
/** Public, secret-free view (what credential.list returns / the UI renders). */
export interface CredentialSummary {
    id: string;
    type: CredentialType;
    label: string;
    createdAt: string;
    updatedAt: string;
    /** Secret-free hints for pickers (e.g. apiKey header name, oauth2 scopes). */
    meta?: Record<string, unknown>;
}
/**
 * Secret payload shapes by type (validated on create):
 *   apiKey: { headerName, value } · bearer: { token } · basic: { username, password }
 *   oauth2: { accessToken, refreshToken?, tokenUrl?, clientId?, clientSecret?, scopes? }
 *   custom: { headers: Record<string,string> }
 */
export type CredentialData = Record<string, unknown>;
export declare class CredentialVault {
    private readonly dir;
    constructor(ownerProfileDir?: string);
    private keyPath;
    private ensureKey;
    private encrypt;
    private decrypt;
    private filePath;
    list(): CredentialSummary[];
    create(input: {
        type: CredentialType;
        label: string;
        data: CredentialData;
        meta?: Record<string, unknown>;
        id?: string;
    }): CredentialSummary;
    /** Decrypted payload — engine-internal use ONLY (execution-time injection). Never over RPC. */
    get(id: string): {
        summary: CredentialSummary;
        data: CredentialData;
    };
    delete(id: string): boolean;
    /** Update the secret payload in place (e.g. oauth2 token refresh / exchange completion). */
    updateData(id: string, data: CredentialData, metaPatch?: Record<string, unknown>): CredentialSummary;
}
export declare function validateCredentialData(type: CredentialType, data: CredentialData): void;
/** Materialize a credential into HTTP request headers (the engine-side injection point). */
export declare function credentialToHeaders(type: CredentialType, data: CredentialData): Record<string, string>;
