export declare const SECRET_STORE_PROVIDERS: readonly ["supabase-vault"];
export type KnownSecretStoreProvider = (typeof SECRET_STORE_PROVIDERS)[number];
export type SecretStoreProvider = KnownSecretStoreProvider | (string & {});
export type SecretRef = string;
export interface SecretScope {
    projectId: string;
    environment: string;
}
export type SecretPayload = Readonly<Record<string, string>>;
export interface SecretMetadata {
    ref: SecretRef;
    scope: SecretScope;
    kind: string;
    provider?: string;
    configuredFields: readonly string[];
    createdAt: string;
    updatedAt: string;
}
export declare const SECRET_STORE_ERROR_CODES: readonly ["invalid_config", "invalid_reference", "invalid_payload", "not_found", "conflict", "permission_denied", "unavailable", "provider_error"];
export type SecretStoreErrorCode = (typeof SECRET_STORE_ERROR_CODES)[number];
export interface SecretStoreError {
    code: SecretStoreErrorCode;
    message: string;
    cause?: unknown;
}
export type SecretStoreOkResult<TData> = [TData] extends [void] ? {
    ok: true;
    data?: undefined;
} : {
    ok: true;
    data: TData;
};
export type SecretStoreResult<TData = void> = SecretStoreOkResult<TData> | {
    ok: false;
    error: SecretStoreError;
};
export interface SecretListInput {
    scope: SecretScope;
    kind?: string;
    provider?: string;
}
export interface SecretGetMetadataInput {
    scope: SecretScope;
    ref: SecretRef;
}
export interface SecretCreateInput {
    scope: SecretScope;
    ref: SecretRef;
    kind: string;
    provider?: string;
    payload: SecretPayload;
}
export interface SecretReplaceInput {
    scope: SecretScope;
    ref: SecretRef;
    payload: SecretPayload;
}
export interface SecretRemoveInput {
    scope: SecretScope;
    ref: SecretRef;
}
export interface SecretResolveInput {
    scope: SecretScope;
    ref: SecretRef;
}
/**
 * Provider-neutral server-side secret-store boundary.
 *
 * `resolve` is for trusted server/deployment code only. Browser bridges must expose
 * metadata operations without forwarding raw secret payloads.
 */
export interface SecretStoreAdapter {
    list(input: SecretListInput): Promise<SecretStoreResult<readonly SecretMetadata[]>>;
    getMetadata(input: SecretGetMetadataInput): Promise<SecretStoreResult<SecretMetadata>>;
    create(input: SecretCreateInput): Promise<SecretStoreResult<SecretMetadata>>;
    replace(input: SecretReplaceInput): Promise<SecretStoreResult<SecretMetadata>>;
    remove(input: SecretRemoveInput): Promise<SecretStoreResult>;
    resolve(input: SecretResolveInput): Promise<SecretStoreResult<SecretPayload>>;
}
export declare function normalizeSecretRef(value: string): SecretStoreResult<SecretRef>;
export declare function normalizeSecretScope(scope: SecretScope): SecretStoreResult<SecretScope>;
export declare function validateSecretPayload(payload: SecretPayload): SecretStoreResult<SecretPayload>;
export declare const FORBIDDEN_INLINE_SECRET_FIELDS: readonly ["apiKey", "clientSecret", "databasePassword", "privateKey", "serviceRoleKey", "token"];
export declare function findForbiddenInlineSecretFields(value: unknown): readonly string[];
//# sourceMappingURL=secrets.d.ts.map