import type { HttpClient } from "../core/http.js";
import type { RotateSecretRequest, SecretResponse, SecretMetadataResponse, SecretListResponse, SecretVersionListResponse, OneclawResponse } from "../types.js";
export interface SetSecretOptions {
    type?: string;
    metadata?: Record<string, unknown>;
    expires_at?: string;
    rotation_policy?: Record<string, unknown>;
    max_access_count?: number;
}
export interface GetSecretOptions {
    /** Reason for accessing this secret (logged in the audit trail). */
    reason?: string;
}
/**
 * Secrets resource — store, retrieve, list, rotate, and delete secrets
 * within a vault.
 */
export declare class SecretsResource {
    private readonly http;
    constructor(http: HttpClient);
    /**
     * Store or update a secret at the given path inside a vault.
     * Returns the secret metadata (without the plaintext value).
     */
    set(vaultId: string, key: string, value: string, options?: SetSecretOptions): Promise<OneclawResponse<SecretMetadataResponse>>;
    /**
     * Retrieve a decrypted secret value.
     * May return a `PaymentRequiredError` (402) or `ApprovalRequiredError`
     * depending on access policies.
     */
    get(vaultId: string, key: string, _options?: GetSecretOptions): Promise<OneclawResponse<SecretResponse>>;
    /** Delete a secret from a vault. */
    delete(vaultId: string, key: string): Promise<OneclawResponse<void>>;
    /** List secret keys (metadata only, no plaintext values). */
    list(vaultId: string, prefix?: string): Promise<OneclawResponse<SecretListResponse>>;
    /**
     * Rotate a secret by writing a new value at the same path.
     * This increments the version.
     */
    rotate(vaultId: string, key: string, newValue: string, options?: SetSecretOptions): Promise<OneclawResponse<SecretMetadataResponse>>;
    /**
     * Server-side rotation: the vault generates a cryptographically random
     * value and stores it as the next version. The caller never sees or
     * transmits the raw secret.
     */
    rotateGenerate(vaultId: string, key: string, options?: RotateSecretRequest): Promise<OneclawResponse<SecretMetadataResponse>>;
    /** List all versions of a secret at the given path. */
    listVersions(vaultId: string, key: string): Promise<OneclawResponse<SecretVersionListResponse>>;
    /** Retrieve a specific version of a secret. */
    getVersion(vaultId: string, key: string, version: number): Promise<OneclawResponse<SecretResponse>>;
    /** Disable a specific version so it can no longer be read (retained for audit). */
    disableVersion(vaultId: string, key: string, version: number): Promise<OneclawResponse<void>>;
}
//# sourceMappingURL=secrets.d.ts.map