axvault 1.0.0

package/dist/db/repositories/audit-log.js

@@ -0,0 +1,58 @@
+/**
+ * Audit log repository.
+ *
+ * Records all credential access for security auditing.
+ */
+/** Convert database row to entry */
+function rowToEntry(row) {
+    return {
+        id: row.id,
+        timestamp: new Date(row.timestamp),
+        apiKeyId: row.api_key_id ?? undefined,
+        action: row.action,
+        agent: row.agent ?? undefined,
+        name: row.name ?? undefined,
+        success: row.success === 1,
+        errorMessage: row.error_message ?? undefined,
+    };
+}
+const SELECT_COLUMNS = `id, timestamp, api_key_id, action, agent, name, success, error_message`;
+/** Log a credential access event */
+function logAccess(database, entry) {
+    /* eslint-disable unicorn/no-null -- SQLite requires null for NULL values */
+    database
+        .prepare(`INSERT INTO audit_log (timestamp, api_key_id, action, agent, name, success, error_message) VALUES (?, ?, ?, ?, ?, ?, ?)`)
+        .run(Date.now(), entry.apiKeyId ?? null, entry.action, entry.agent ?? null, entry.name ?? null, entry.success ? 1 : 0, entry.errorMessage ?? null);
+    /* eslint-enable unicorn/no-null */
+}
+/** Get recent audit log entries */
+function getRecentLogs(database, options) {
+    const limit = Math.max(1, Math.min(options?.limit ?? 100, 1000));
+    const parameters = [];
+    let query = `SELECT ${SELECT_COLUMNS} FROM audit_log`;
+    if (options?.apiKeyId) {
+        query += ` WHERE api_key_id = ?`;
+        parameters.push(options.apiKeyId);
+    }
+    query += ` ORDER BY timestamp DESC LIMIT ?`;
+    parameters.push(limit);
+    return database.prepare(query).all(...parameters).map((row) => rowToEntry(row));
+}
+/** Get logs for a specific credential */
+function getLogsForCredential(database, agent, name, limit_ = 50) {
+    const limit = Math.max(1, Math.min(limit_, 1000));
+    const rows = database
+        .prepare(`SELECT ${SELECT_COLUMNS} FROM audit_log WHERE agent = ? AND name = ? ORDER BY timestamp DESC LIMIT ?`)
+        .all(agent, name, limit);
+    return rows.map((row) => rowToEntry(row));
+}
+/** Prune old audit log entries */
+function pruneOldLogs(database, olderThanDays) {
+    if (!Number.isFinite(olderThanDays) || olderThanDays <= 0)
+        return 0;
+    const cutoff = Date.now() - olderThanDays * 24 * 60 * 60 * 1000;
+    return database
+        .prepare(`DELETE FROM audit_log WHERE timestamp < ?`)
+        .run(cutoff).changes;
+}
+export { getLogsForCredential, getRecentLogs, logAccess, pruneOldLogs };

package/dist/db/repositories/credentials.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Credentials repository.
+ *
+ * Manages encrypted credential storage.
+ */
+import type Database from "better-sqlite3";
+/** Credential record stored in database */
+interface CredentialRecord {
+    agent: string;
+    name: string;
+    encryptedData: Buffer;
+    salt: Buffer;
+    iv: Buffer;
+    authTag: Buffer;
+    createdAt: Date;
+    updatedAt: Date;
+    expiresAt: Date | undefined;
+}
+/** Credential metadata (without encrypted data) */
+interface CredentialMetadata {
+    agent: string;
+    name: string;
+    createdAt: Date;
+    updatedAt: Date;
+    expiresAt: Date | undefined;
+}
+/** Store or update a credential */
+declare function upsertCredential(database: Database.Database, credential: {
+    agent: string;
+    name: string;
+    encryptedData: Buffer;
+    salt: Buffer;
+    iv: Buffer;
+    authTag: Buffer;
+    expiresAt?: Date;
+}): void;
+/** Get a credential by agent and name */
+declare function getCredential(database: Database.Database, agent: string, name: string): CredentialRecord | undefined;
+/** List all credentials (metadata only) */
+declare function listCredentials(database: Database.Database): CredentialMetadata[];
+/** List credentials accessible by an API key's read access list */
+declare function listCredentialsForApiKey(database: Database.Database, readAccess: string[]): CredentialMetadata[];
+/** Delete a credential */
+declare function deleteCredential(database: Database.Database, agent: string, name: string): boolean;
+/** Update expiration time after refresh */
+declare function updateExpiresAt(database: Database.Database, agent: string, name: string, expiresAt: Date | undefined): void;
+export { deleteCredential, getCredential, listCredentials, listCredentialsForApiKey, updateExpiresAt, upsertCredential, };
+export type { CredentialMetadata, CredentialRecord };

package/dist/db/repositories/credentials.js

@@ -0,0 +1,79 @@
+/**
+ * Credentials repository.
+ *
+ * Manages encrypted credential storage.
+ */
+/** Convert database row to record */
+function rowToRecord(row) {
+    if (!row.salt) {
+        throw new Error("Credential missing salt - database may need migration");
+    }
+    return {
+        agent: row.agent,
+        name: row.name,
+        encryptedData: row.encrypted_data,
+        salt: row.salt,
+        iv: row.iv,
+        authTag: row.auth_tag,
+        createdAt: new Date(row.created_at),
+        updatedAt: new Date(row.updated_at),
+        expiresAt: row.expires_at ? new Date(row.expires_at) : undefined,
+    };
+}
+/** Convert metadata row to metadata */
+function rowToMetadata(row) {
+    return {
+        agent: row.agent,
+        name: row.name,
+        createdAt: new Date(row.created_at),
+        updatedAt: new Date(row.updated_at),
+        expiresAt: row.expires_at ? new Date(row.expires_at) : undefined,
+    };
+}
+/** Store or update a credential */
+function upsertCredential(database, credential) {
+    const now = Date.now();
+    /* eslint-disable unicorn/no-null -- SQLite requires null for NULL values */
+    database
+        .prepare(`INSERT INTO credentials (agent, name, encrypted_data, salt, iv, auth_tag, created_at, updated_at, expires_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+     ON CONFLICT(agent, name) DO UPDATE SET
+       encrypted_data = excluded.encrypted_data, salt = excluded.salt, iv = excluded.iv, auth_tag = excluded.auth_tag,
+       updated_at = excluded.updated_at, expires_at = excluded.expires_at`)
+        .run(credential.agent, credential.name, credential.encryptedData, credential.salt, credential.iv, credential.authTag, now, now, credential.expiresAt?.getTime() ?? null);
+    /* eslint-enable unicorn/no-null */
+}
+/** Get a credential by agent and name */
+function getCredential(database, agent, name) {
+    const row = database
+        .prepare(`SELECT agent, name, encrypted_data, salt, iv, auth_tag, created_at, updated_at, expires_at FROM credentials WHERE agent = ? AND name = ?`)
+        .get(agent, name);
+    return row ? rowToRecord(row) : undefined;
+}
+/** List all credentials (metadata only) */
+function listCredentials(database) {
+    const rows = database
+        .prepare(`SELECT agent, name, created_at, updated_at, expires_at FROM credentials ORDER BY agent, name`)
+        .all();
+    return rows.map((row) => rowToMetadata(row));
+}
+/** List credentials accessible by an API key's read access list */
+function listCredentialsForApiKey(database, readAccess) {
+    if (readAccess.includes("*"))
+        return listCredentials(database);
+    return listCredentials(database).filter((cred) => readAccess.includes(`${cred.agent}/${cred.name}`));
+}
+/** Delete a credential */
+function deleteCredential(database, agent, name) {
+    return (database
+        .prepare(`DELETE FROM credentials WHERE agent = ? AND name = ?`)
+        .run(agent, name).changes > 0);
+}
+/** Update expiration time after refresh */
+function updateExpiresAt(database, agent, name, expiresAt) {
+    database
+        .prepare(`UPDATE credentials SET expires_at = ?, updated_at = ? WHERE agent = ? AND name = ?`)
+        // eslint-disable-next-line unicorn/no-null -- SQLite requires null for NULL values
+        .run(expiresAt?.getTime() ?? null, Date.now(), agent, name);
+}
+export { deleteCredential, getCredential, listCredentials, listCredentialsForApiKey, updateExpiresAt, upsertCredential, };

package/dist/db/types.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Database row types and conversion utilities.
+ */
+/** Raw API key row from database */
+export interface ApiKeyRow {
+    id: string;
+    name: string;
+    key_hash: string;
+    read_access: string;
+    write_access: string;
+    created_at: number;
+    last_used_at: number | null;
+}
+/** Raw audit log row from database */
+export interface AuditLogRow {
+    id: number;
+    timestamp: number;
+    api_key_id: string | null;
+    action: string;
+    agent: string | null;
+    name: string | null;
+    success: number;
+    error_message: string | null;
+}
+/** Raw credential row from database */
+export interface CredentialRow {
+    agent: string;
+    name: string;
+    encrypted_data: Buffer;
+    salt: Buffer | null;
+    iv: Buffer;
+    auth_tag: Buffer;
+    created_at: number;
+    updated_at: number;
+    expires_at: number | null;
+}
+/** Raw credential metadata row from database */
+export interface MetadataRow {
+    agent: string;
+    name: string;
+    created_at: number;
+    updated_at: number;
+    expires_at: number | null;
+}

package/dist/db/types.js

@@ -0,0 +1,4 @@
+/**
+ * Database row types and conversion utilities.
+ */
+export {};

package/dist/handlers/delete-credential.d.ts

@@ -0,0 +1,15 @@
+/**
+ * DELETE /api/v1/credentials/:agent/:name handler.
+ */
+import type { RequestHandler } from "express";
+import type Database from "better-sqlite3";
+/** Handler type for credential routes with agent/name params */
+type CredentialHandler = RequestHandler<{
+    agent: string;
+    name: string;
+}, unknown, unknown, unknown>;
+/**
+ * Remove a credential.
+ */
+declare function createDeleteCredentialHandler(database: Database.Database): CredentialHandler;
+export { createDeleteCredentialHandler };

package/dist/handlers/delete-credential.js

@@ -0,0 +1,50 @@
+/**
+ * DELETE /api/v1/credentials/:agent/:name handler.
+ */
+import { hasWriteAccess } from "../db/repositories/api-keys.js";
+import { deleteCredential } from "../db/repositories/credentials.js";
+import { logAccess } from "../db/repositories/audit-log.js";
+/**
+ * Remove a credential.
+ */
+function createDeleteCredentialHandler(database) {
+    return (request, response) => {
+        const authenticatedRequest = request;
+        const { agent, name } = request.params;
+        const { apiKey } = authenticatedRequest;
+        if (!hasWriteAccess(apiKey, agent, name)) {
+            logAccess(database, {
+                apiKeyId: apiKey.id,
+                action: "delete",
+                agent,
+                name,
+                success: false,
+                errorMessage: "Access denied",
+            });
+            response.status(403).json({ error: "Access denied" });
+            return;
+        }
+        const deleted = deleteCredential(database, agent, name);
+        if (!deleted) {
+            logAccess(database, {
+                apiKeyId: apiKey.id,
+                action: "delete",
+                agent,
+                name,
+                success: false,
+                errorMessage: "Not found",
+            });
+            response.status(404).json({ error: "Credential not found" });
+            return;
+        }
+        logAccess(database, {
+            apiKeyId: apiKey.id,
+            action: "delete",
+            agent,
+            name,
+            success: true,
+        });
+        response.json({ message: "Credential deleted", agent, name });
+    };
+}
+export { createDeleteCredentialHandler };

package/dist/handlers/get-credential.d.ts

@@ -0,0 +1,21 @@
+/**
+ * GET /api/v1/credentials/:agent/:name handler.
+ */
+import type { Request, Response } from "express";
+import type Database from "better-sqlite3";
+/** Handler configuration */
+interface GetCredentialConfig {
+    refreshThresholdSeconds: number;
+    refreshTimeoutMs: number;
+}
+/**
+ * Retrieve a credential by agent and name.
+ *
+ * Automatically refreshes credentials that are near expiration.
+ */
+declare function createGetCredentialHandler(database: Database.Database, config: GetCredentialConfig): (request: Request<{
+    agent: string;
+    name: string;
+}>, response: Response) => Promise<void>;
+export { createGetCredentialHandler };
+export type { GetCredentialConfig };

package/dist/handlers/get-credential.js

@@ -0,0 +1,143 @@
+/**
+ * GET /api/v1/credentials/:agent/:name handler.
+ */
+import { hasReadAccess } from "../db/repositories/api-keys.js";
+import { getCredential } from "../db/repositories/credentials.js";
+import { logAccess } from "../db/repositories/audit-log.js";
+import { decryptCredential } from "../lib/encryption.js";
+import { isRefreshable, needsRefresh, refreshWithMutex, } from "../refresh/refresh-manager.js";
+/**
+ * Retrieve a credential by agent and name.
+ *
+ * Automatically refreshes credentials that are near expiration.
+ */
+function createGetCredentialHandler(database, config) {
+    return async (request, response) => {
+        const authenticatedRequest = request;
+        const { agent, name } = request.params;
+        const { apiKey } = authenticatedRequest;
+        // Access control check
+        if (!hasReadAccess(apiKey, agent, name)) {
+            logAccess(database, {
+                apiKeyId: apiKey.id,
+                action: "read",
+                agent,
+                name,
+                success: false,
+                errorMessage: "Access denied",
+            });
+            response.status(403).json({ error: "Access denied" });
+            return;
+        }
+        // Fetch credential from database
+        let credential;
+        try {
+            credential = getCredential(database, agent, name);
+        }
+        catch (error) {
+            // Handle legacy credentials stored without salt (pre-v2 migration)
+            if (error instanceof Error && error.message.includes("missing salt")) {
+                logAccess(database, {
+                    apiKeyId: apiKey.id,
+                    action: "read",
+                    agent,
+                    name,
+                    success: false,
+                    errorMessage: "Legacy credential requires re-upload",
+                });
+                response.status(410).json({
+                    error: "This credential was stored with legacy encryption and must be deleted and re-uploaded",
+                });
+                return;
+            }
+            throw error;
+        }
+        if (!credential) {
+            logAccess(database, {
+                apiKeyId: apiKey.id,
+                action: "read",
+                agent,
+                name,
+                success: false,
+                errorMessage: "Not found",
+            });
+            response.status(404).json({ error: "Credential not found" });
+            return;
+        }
+        // Decrypt credential data
+        let data;
+        try {
+            data = decryptCredential(credential);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            logAccess(database, {
+                apiKeyId: apiKey.id,
+                action: "read",
+                agent,
+                name,
+                success: false,
+                errorMessage: `Decryption failed: ${message}`,
+            });
+            response.status(500).json({ error: "Failed to decrypt credential" });
+            return;
+        }
+        // Check if refresh is needed (isRefreshable is a type guard)
+        // When refreshThresholdSeconds is 0, auto-refresh is disabled
+        let finalData = data;
+        let finalExpiresAt = credential.expiresAt;
+        let finalUpdatedAt = credential.updatedAt;
+        let wasRefreshed = false;
+        let refreshFailed = false;
+        if (config.refreshThresholdSeconds > 0 &&
+            isRefreshable(data) &&
+            needsRefresh(data, config.refreshThresholdSeconds)) {
+            try {
+                const refreshResult = await refreshWithMutex(database, agent, name, data, apiKey.id, credential.updatedAt, { timeoutMs: config.refreshTimeoutMs });
+                if (refreshResult.ok) {
+                    finalData = refreshResult.data;
+                    finalExpiresAt = refreshResult.expiresAt;
+                    finalUpdatedAt = refreshResult.updatedAt;
+                    wasRefreshed = true;
+                }
+                else {
+                    // Refresh failed - will return stale credentials with warning header
+                    // Error details logged by refreshWithMutex to audit log
+                    refreshFailed = true;
+                }
+            }
+            catch (error) {
+                // Programming error safety net - refreshWithMutex handles all expected
+                // errors internally and returns { ok: false }. This catch is for bugs
+                // in our code, not provider errors. Only log message, not stack/object.
+                console.error(`Unexpected refresh error for ${agent}/${name}:`, error instanceof Error ? error.message : error);
+                refreshFailed = true;
+            }
+        }
+        // Log successful read
+        logAccess(database, {
+            apiKeyId: apiKey.id,
+            action: "read",
+            agent,
+            name,
+            success: true,
+        });
+        // Set refresh header if token was refreshed
+        if (wasRefreshed) {
+            response.setHeader("X-Axvault-Refreshed", "true");
+        }
+        // Set warning header if refresh failed (still return 200 with stale data)
+        // Error details are logged to audit log; header is boolean to avoid invalid chars
+        if (refreshFailed) {
+            response.setHeader("X-Axvault-Refresh-Failed", "true");
+        }
+        response.json({
+            agent,
+            name,
+            data: finalData,
+            expiresAt: finalExpiresAt?.toISOString(),
+            updatedAt: finalUpdatedAt.toISOString(),
+        });
+    };
+}
+export { createGetCredentialHandler };

package/dist/handlers/list-credentials.d.ts

@@ -0,0 +1,12 @@
+/**
+ * GET /api/v1/credentials handler.
+ */
+import type { RequestHandler } from "express";
+import type Database from "better-sqlite3";
+/** Handler type for list route (no params) */
+type ListHandler = RequestHandler<Record<string, never>, unknown, unknown, unknown>;
+/**
+ * List all credentials accessible by the API key (metadata only).
+ */
+declare function createListCredentialsHandler(database: Database.Database): ListHandler;
+export { createListCredentialsHandler };

package/dist/handlers/list-credentials.js

@@ -0,0 +1,29 @@
+/**
+ * GET /api/v1/credentials handler.
+ */
+import { listCredentialsForApiKey } from "../db/repositories/credentials.js";
+import { logAccess } from "../db/repositories/audit-log.js";
+/**
+ * List all credentials accessible by the API key (metadata only).
+ */
+function createListCredentialsHandler(database) {
+    return (request, response) => {
+        const authenticatedRequest = request;
+        const { apiKey } = authenticatedRequest;
+        const credentials = listCredentialsForApiKey(database, apiKey.readAccess);
+        logAccess(database, {
+            apiKeyId: apiKey.id,
+            action: "list",
+            success: true,
+        });
+        response.json({
+            credentials: credentials.map((cred) => ({
+                agent: cred.agent,
+                name: cred.name,
+                expiresAt: cred.expiresAt?.toISOString(),
+                updatedAt: cred.updatedAt.toISOString(),
+            })),
+        });
+    };
+}
+export { createListCredentialsHandler };

package/dist/handlers/put-credential.d.ts

@@ -0,0 +1,15 @@
+/**
+ * PUT /api/v1/credentials/:agent/:name handler.
+ */
+import type { RequestHandler } from "express";
+import type Database from "better-sqlite3";
+/** Handler type for credential routes with agent/name params */
+type CredentialHandler = RequestHandler<{
+    agent: string;
+    name: string;
+}, unknown, unknown, unknown>;
+/**
+ * Store or update a credential.
+ */
+declare function createPutCredentialHandler(database: Database.Database): CredentialHandler;
+export { createPutCredentialHandler };

package/dist/handlers/put-credential.js

@@ -0,0 +1,94 @@
+/**
+ * PUT /api/v1/credentials/:agent/:name handler.
+ */
+import { hasWriteAccess } from "../db/repositories/api-keys.js";
+import { upsertCredential } from "../db/repositories/credentials.js";
+import { logAccess } from "../db/repositories/audit-log.js";
+import { encryptCredential } from "../lib/encryption.js";
+/**
+ * Store or update a credential.
+ */
+function createPutCredentialHandler(database) {
+    return (request, response) => {
+        const authenticatedRequest = request;
+        const { agent, name } = request.params;
+        const { apiKey } = authenticatedRequest;
+        if (!hasWriteAccess(apiKey, agent, name)) {
+            logAccess(database, {
+                apiKeyId: apiKey.id,
+                action: "write",
+                agent,
+                name,
+                success: false,
+                errorMessage: "Access denied",
+            });
+            response.status(403).json({ error: "Access denied" });
+            return;
+        }
+        const body = request.body;
+        if (!body || typeof body.data !== "object" || body.data === null) {
+            logAccess(database, {
+                apiKeyId: apiKey.id,
+                action: "write",
+                agent,
+                name,
+                success: false,
+                errorMessage: "Invalid request body",
+            });
+            response
+                .status(400)
+                .json({ error: "Request body must include 'data' object" });
+            return;
+        }
+        try {
+            const encrypted = encryptCredential(body.data);
+            let expiresAt;
+            if (body.expiresAt) {
+                expiresAt = new Date(body.expiresAt);
+                if (Number.isNaN(expiresAt.getTime())) {
+                    logAccess(database, {
+                        apiKeyId: apiKey.id,
+                        action: "write",
+                        agent,
+                        name,
+                        success: false,
+                        errorMessage: "Invalid expiresAt date",
+                    });
+                    response.status(400).json({ error: "Invalid expiresAt date" });
+                    return;
+                }
+            }
+            upsertCredential(database, {
+                agent,
+                name,
+                ...encrypted,
+                expiresAt,
+            });
+            logAccess(database, {
+                apiKeyId: apiKey.id,
+                action: "write",
+                agent,
+                name,
+                success: true,
+            });
+            response.status(201).json({
+                message: "Credential stored",
+                agent,
+                name,
+            });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            logAccess(database, {
+                apiKeyId: apiKey.id,
+                action: "write",
+                agent,
+                name,
+                success: false,
+                errorMessage: `Encryption failed: ${message}`,
+            });
+            response.status(500).json({ error: "Failed to encrypt credential" });
+        }
+    };
+}
+export { createPutCredentialHandler };

package/dist/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * axvault - Remote credential storage server for axpoint.
+ *
+ * This module exports types and functions for programmatic use.
+ */
+export type { ServerConfig } from "./config.js";
+export { getServerConfig } from "./config.js";
+export type { AxvaultServer } from "./server/server.js";
+export { createServer } from "./server/server.js";
+export { createApiRouter } from "./server/routes.js";
+export { closeDatabase, getDatabase, isDatabaseConnected, } from "./db/client.js";
+export { CURRENT_VERSION, getSchemaVersion, runMigrations, } from "./db/migrations.js";
+export type { ApiKeyRecord, ApiKeyWithSecret, } from "./db/repositories/api-keys.js";
+export { createApiKey, deleteApiKey, findApiKeyById, findApiKeyByKey, hasReadAccess, hasWriteAccess, listApiKeys, updateLastUsed, } from "./db/repositories/api-keys.js";
+export type { AuditLogEntry } from "./db/repositories/audit-log.js";
+export { getLogsForCredential, getRecentLogs, logAccess, pruneOldLogs, } from "./db/repositories/audit-log.js";
+export type { CredentialMetadata, CredentialRecord, } from "./db/repositories/credentials.js";
+export { deleteCredential, getCredential, listCredentials, listCredentialsForApiKey, updateExpiresAt, upsertCredential, } from "./db/repositories/credentials.js";

package/dist/index.js

@@ -0,0 +1,14 @@
+/**
+ * axvault - Remote credential storage server for axpoint.
+ *
+ * This module exports types and functions for programmatic use.
+ */
+export { getServerConfig } from "./config.js";
+export { createServer } from "./server/server.js";
+export { createApiRouter } from "./server/routes.js";
+// Database client
+export { closeDatabase, getDatabase, isDatabaseConnected, } from "./db/client.js";
+export { CURRENT_VERSION, getSchemaVersion, runMigrations, } from "./db/migrations.js";
+export { createApiKey, deleteApiKey, findApiKeyById, findApiKeyByKey, hasReadAccess, hasWriteAccess, listApiKeys, updateLastUsed, } from "./db/repositories/api-keys.js";
+export { getLogsForCredential, getRecentLogs, logAccess, pruneOldLogs, } from "./db/repositories/audit-log.js";
+export { deleteCredential, getCredential, listCredentials, listCredentialsForApiKey, updateExpiresAt, upsertCredential, } from "./db/repositories/credentials.js";

package/dist/lib/encryption.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Encryption utilities for credential storage.
+ *
+ * Wraps axshared encryption functions with vault-specific configuration.
+ */
+/** Encrypted credential data stored in database */
+interface EncryptedCredential {
+    encryptedData: Buffer;
+    salt: Buffer;
+    iv: Buffer;
+    authTag: Buffer;
+}
+/** Encrypt credential data for storage */
+declare function encryptCredential(data: unknown): EncryptedCredential;
+/** Decrypt credential data from storage */
+declare function decryptCredential(credential: EncryptedCredential): unknown;
+export { decryptCredential, encryptCredential };