import { type SecretScope } from "@agent-native/core/secrets";
import { schema } from "../../db/index.js";
export type VaultAccessMode = "all-apps" | "manual";
export interface VaultAccessSettings {
    mode: VaultAccessMode;
    scope: "org" | "user";
    scopeId: string;
}
/**
 * Caller-supplied access context for vault operations.
 *
 * Every getSecret / updateSecret / deleteSecret / createGrant call must
 * pass the ctx of the *current request* so the row is scoped to that
 * caller's tenant. Looking up a vault secret by id alone is unsafe — UUIDs
 * are not authorization. A row matches the ctx if either the caller owns
 * it or it lives in the caller's active org.
 */
export interface VaultCtx {
    ownerEmail: string;
    orgId: string | null;
}
/**
 * Build a VaultCtx from the current request. Throws if the request is
 * unauthenticated — the previous behavior of falling back to "local@localhost"
 * leaked rows across tenants when a misconfigured environment skipped auth.
 */
export declare function requireVaultCtx(): VaultCtx;
export declare function isTrustedEnvVarSyncAgentUrl(agentUrl: string): boolean;
/**
 * Shared vault values and grants are organization administration data. Keep
 * the member path available for request creation and safe key metadata, but
 * fail closed before a member can read or mutate a raw secret.
 */
export declare function assertCanManageVault(): Promise<void>;
export declare function canManageVault(): Promise<boolean>;
export declare function getVaultAccessSettings(): Promise<VaultAccessSettings>;
export declare function setVaultAccessSettings(input: {
    mode: VaultAccessMode;
}): Promise<VaultAccessSettings>;
export declare function recordVaultAudit(input: {
    action: string;
    secretId?: string | null;
    appId?: string | null;
    summary: string;
    metadata?: unknown;
    actor?: string;
}): Promise<void>;
export declare function listVaultAudit(limit?: number): Promise<{
    id: string;
    ownerEmail: string;
    orgId: string | null;
    secretId: string | null;
    appId: string | null;
    action: string;
    actor: string;
    summary: string;
    metadata: string | null;
    createdAt: number;
}[]>;
export declare function listSecrets(): Promise<{
    id: string;
    ownerEmail: string;
    orgId: string | null;
    name: string;
    credentialKey: string;
    value: string;
    provider: string | null;
    description: string | null;
    createdBy: string;
    createdAt: number;
    updatedAt: number;
}[]>;
/** Safe metadata for app creation and integration readiness checks. */
export declare function listSecretOptions(): Promise<{
    id: string;
    name: string;
    credentialKey: string;
    provider: string | null;
    description: string | null;
}[]>;
export declare function getSecret(secretId: string, ctx: VaultCtx): Promise<{
    id: string;
    ownerEmail: string;
    orgId: string | null;
    name: string;
    credentialKey: string;
    value: string;
    provider: string | null;
    description: string | null;
    createdBy: string;
    createdAt: number;
    updatedAt: number;
}>;
export declare function createSecret(input: {
    credentialKey: string;
    value: string;
    name: string;
    provider?: string | null;
    description?: string | null;
}, ctx?: VaultCtx): Promise<{
    id: string;
    ownerEmail: string;
    orgId: string | null;
    name: string;
    credentialKey: string;
    value: string;
    provider: string | null;
    description: string | null;
    createdBy: string;
    createdAt: number;
    updatedAt: number;
}>;
export declare function updateSecret(secretId: string, input: string | {
    credentialKey?: string;
    value?: string;
    name?: string;
    provider?: string | null;
    description?: string | null;
}, ctx?: VaultCtx): Promise<{
    id: string;
    ownerEmail: string;
    orgId: string | null;
    name: string;
    credentialKey: string;
    value: string;
    provider: string | null;
    description: string | null;
    createdBy: string;
    createdAt: number;
    updatedAt: number;
}>;
export declare function deleteSecret(secretId: string, ctx?: VaultCtx): Promise<{
    id: string;
    ownerEmail: string;
    orgId: string | null;
    name: string;
    credentialKey: string;
    value: string;
    provider: string | null;
    description: string | null;
    createdBy: string;
    createdAt: number;
    updatedAt: number;
}>;
export declare function listGrants(filter?: {
    secretId?: string;
    appId?: string;
}): Promise<{
    id: string;
    ownerEmail: string;
    orgId: string | null;
    secretId: string;
    appId: string;
    grantedBy: string;
    status: string;
    syncedAt: number | null;
    createdAt: number;
    updatedAt: number;
}[]>;
export declare function getGrant(grantId: string, ctx?: VaultCtx): Promise<{
    id: string;
    ownerEmail: string;
    orgId: string | null;
    secretId: string;
    appId: string;
    grantedBy: string;
    status: string;
    syncedAt: number | null;
    createdAt: number;
    updatedAt: number;
}>;
export declare function createGrant(secretId: string, appId: string, ctx?: VaultCtx): Promise<{
    id: string;
    ownerEmail: string;
    orgId: string | null;
    secretId: string;
    appId: string;
    grantedBy: string;
    status: string;
    syncedAt: number | null;
    createdAt: number;
    updatedAt: number;
}>;
export declare function grantSecretsToApp(secretIds: string[], appId: string, ctx?: VaultCtx): Promise<{
    appId: string;
    accessMode: "all-apps";
    created: never[];
    skipped: string[];
} | {
    appId: string;
    accessMode: "manual";
    created: {
        id: string;
        ownerEmail: string;
        orgId: string | null;
        secretId: string;
        appId: string;
        grantedBy: string;
        status: string;
        syncedAt: number | null;
        createdAt: number;
        updatedAt: number;
    }[];
    skipped: string[];
}>;
export declare function revokeGrant(grantId: string, ctx?: VaultCtx): Promise<{
    id: string;
    ownerEmail: string;
    orgId: string | null;
    secretId: string;
    appId: string;
    grantedBy: string;
    status: string;
    syncedAt: number | null;
    createdAt: number;
    updatedAt: number;
}>;
type VaultSecretRow = typeof schema.vaultSecrets.$inferSelect;
export declare function credentialStoreScopeForVaultCtx(ctx: VaultCtx): {
    scope: Extract<SecretScope, "org" | "workspace">;
    scopeId: string;
};
export declare function syncSecretsToCredentialStore(secrets: VaultSecretRow[], ctx: VaultCtx): Promise<{
    scope: Extract<SecretScope, "org" | "workspace">;
    scopeId: string;
    keys: string[];
}>;
/**
 * Re-sync every vault secret across every tenant into the shared credential
 * store, regardless of which request/ctx is currently active.
 *
 * `syncSecretsToCredentialStore` normally only runs on `createSecret` /
 * `updateSecret`, so it only re-encrypts the rows a user happens to touch.
 * When the shared `app_secrets` encryption format changes underneath it
 * (e.g. a new dual-write format, or a change to how key material is
 * derived), existing rows are stuck on the old format until someone
 * manually re-saves each vault secret. This walks every `vault_secrets`
 * row directly — bypassing the ctx-scoped `listSecrets()` — groups them by
 * their (orgId, ownerEmail) tenant, and re-runs the sync per group so every
 * row regains fresh ciphertext.
 *
 * A failure syncing one tenant's group is caught and logged (key NAMES
 * only, never values) so it can't block the rest of the resync.
 */
export declare function resyncAllVaultSecretsToCredentialStore(): Promise<{
    groups: number;
    failedGroups: number;
    syncedKeys: number;
}>;
export declare function cleanupSyncedCredentialKeysIfUnused(ctx: VaultCtx, candidateKeys?: string[]): Promise<void>;
export declare function syncGrantsToApp(appId: string, ctx?: VaultCtx): Promise<{
    appId: string;
    accessMode: VaultAccessMode;
    synced: number;
    keys: never[];
    credentialStores: never[];
    envVars?: undefined;
} | {
    appId: string;
    accessMode: VaultAccessMode;
    synced: number;
    keys: string[];
    credentialStores: {
        scope: ReturnType<typeof credentialStoreScopeForVaultCtx>["scope"];
        scopeId: string;
        synced: number;
    }[];
    envVars: {
        status: "synced";
        keys: string[];
    } | {
        status: "skipped";
        reason: string;
    } | {
        status: "failed";
        reason: string;
    };
}>;
export declare function listRequests(filter?: {
    status?: string;
}): Promise<{
    id: string;
    ownerEmail: string;
    orgId: string | null;
    credentialKey: string;
    appId: string;
    reason: string | null;
    requestedBy: string;
    status: string;
    reviewedBy: string | null;
    reviewedAt: number | null;
    createdAt: number;
    updatedAt: number;
}[]>;
export declare function getRequest(requestId: string, ctx?: VaultCtx): Promise<{
    id: string;
    ownerEmail: string;
    orgId: string | null;
    credentialKey: string;
    appId: string;
    reason: string | null;
    requestedBy: string;
    status: string;
    reviewedBy: string | null;
    reviewedAt: number | null;
    createdAt: number;
    updatedAt: number;
}>;
export declare function createRequest(input: {
    credentialKey: string;
    appId: string;
    reason?: string | null;
}): Promise<{
    id: string;
    ownerEmail: string;
    orgId: string | null;
    credentialKey: string;
    appId: string;
    reason: string | null;
    requestedBy: string;
    status: string;
    reviewedBy: string | null;
    reviewedAt: number | null;
    createdAt: number;
    updatedAt: number;
}>;
export declare function approveRequest(requestId: string, secretValue: string, secretName?: string, ctx?: VaultCtx): Promise<{
    id: string;
    ownerEmail: string;
    orgId: string | null;
    credentialKey: string;
    appId: string;
    reason: string | null;
    requestedBy: string;
    status: string;
    reviewedBy: string | null;
    reviewedAt: number | null;
    createdAt: number;
    updatedAt: number;
}>;
export declare function denyRequest(requestId: string, reason?: string | null, ctx?: VaultCtx): Promise<{
    id: string;
    ownerEmail: string;
    orgId: string | null;
    credentialKey: string;
    appId: string;
    reason: string | null;
    requestedBy: string;
    status: string;
    reviewedBy: string | null;
    reviewedAt: number | null;
    createdAt: number;
    updatedAt: number;
}>;
export interface IntegrationEntry {
    key: string;
    label: string;
    required: boolean;
    configured: boolean;
    vaultGranted: boolean;
    vaultSecretId?: string;
}
export interface AppIntegrations {
    appId: string;
    appName: string;
    url: string;
    color: string;
    integrations: IntegrationEntry[];
    vaultAccessMode: VaultAccessMode;
    reachable: boolean;
}
export declare function listIntegrationsCatalog(): Promise<AppIntegrations[]>;
export declare function listVaultOverview(): Promise<{
    accessMode: VaultAccessMode;
    secretCount: number;
    activeGrantCount: number;
    manualGrantCount: number;
    pendingRequestCount: number;
}>;
export {};
//# sourceMappingURL=vault-store.d.ts.map