/**
 * Core type definitions for SecretSage
 */
/**
 * A credential with its decrypted value
 */
interface Credential {
    /** Credential name (e.g., OPENAI_API_KEY) */
    name: string;
    /** Decrypted credential value */
    value: string;
    /** Which source provided this credential */
    source: string;
    /** Optional metadata */
    metadata?: CredentialMetadata;
}
/**
 * Rotation event for audit trail
 */
interface RotationEvent {
    /** When the rotation occurred */
    timestamp: Date;
    /** Reason for rotation (e.g., "quarterly rotation") */
    reason?: string;
}
/**
 * Access log entry for audit trail
 */
interface AccessLogEntry {
    /** When the access occurred */
    timestamp: Date;
    /** Type of access */
    action: 'read' | 'grant';
}
/**
 * Credential metadata (stored alongside encrypted value)
 */
interface CredentialMetadata {
    /** Credential name */
    name: string;
    /** When the credential was added */
    createdAt?: Date;
    /** When the credential was last updated */
    updatedAt?: Date;
    /** Optional description */
    description?: string;
    /** Optional tags for organization */
    tags?: string[];
    /** Access scope restrictions */
    scope?: CredentialScope;
    /** Rotation history for audit trail */
    rotationHistory?: RotationEvent[];
}
/**
 * Access scope for a credential
 * Used for agent access control (v2 feature)
 */
interface CredentialScope {
    /** Allowed project paths */
    allowedPaths?: string[];
    /** Allowed agent identifiers */
    allowedAgents?: string[];
    /** Expiration time */
    validUntil?: Date;
}

/**
 * Credential source interface
 *
 * Allows SecretSage to support different credential backends
 * (local vault, 1Password, Bitwarden, Keychain, etc.) through
 * a common interface.
 */

/**
 * Credential source interface
 *
 * Implementations must provide:
 * - Credential CRUD operations
 * - Availability check
 * - List/search functionality
 *
 * The modular design enables plugin-based credential sources.
 */
interface ICredentialSource {
    /** Source identifier (e.g., 'local', '1password', 'bitwarden') */
    readonly id: string;
    /** Human-readable name */
    readonly name: string;
    /** Priority for source resolution (lower = higher priority) */
    readonly priority: number;
    /**
     * Check if the source is available and configured
     * (e.g., vault exists, CLI installed, authenticated)
     */
    isAvailable(): Promise<boolean>;
    /**
     * Get a credential by name
     *
     * @param name - Credential name (e.g., OPENAI_API_KEY)
     * @returns Credential with decrypted value, or null if not found
     */
    get(name: string): Promise<Credential | null>;
    /**
     * List all credential metadata (names, not values)
     *
     * @returns Array of credential metadata
     */
    list(): Promise<CredentialMetadata[]>;
    /**
     * Store a credential
     *
     * @param name - Credential name
     * @param value - Credential value (plaintext)
     * @param metadata - Optional metadata
     */
    set?(name: string, value: string, metadata?: Partial<CredentialMetadata>): Promise<void>;
    /**
     * Delete a credential
     *
     * @param name - Credential name
     * @returns true if deleted, false if not found
     */
    delete?(name: string): Promise<boolean>;
    /**
     * Search credentials by pattern
     *
     * @param pattern - Search pattern (glob or regex)
     * @returns Matching credential metadata
     */
    search?(pattern: string): Promise<CredentialMetadata[]>;
    /**
     * Initialize the source (create vault, authenticate, etc.)
     */
    initialize?(): Promise<void>;
}

/**
 * Encryption provider interface
 *
 * Allows SecretSage to support different encryption backends
 * (age, sodium, GPG, etc.) through a common interface.
 */
/**
 * Key pair for asymmetric encryption
 */
interface KeyPair {
    /** Public key (recipient) - safe to share */
    publicKey: string;
    /** Private key (identity) - must be kept secret */
    privateKey: string;
}
/**
 * Encryption provider interface
 *
 * Implementations must provide:
 * - Key generation
 * - Encrypt with public key
 * - Decrypt with private key
 *
 * The modular design allows swapping encryption backends
 * as standards evolve.
 */
interface IEncryptionProvider {
    /** Provider identifier (e.g., 'age', 'sodium') */
    readonly id: string;
    /** Human-readable name */
    readonly name: string;
    /**
     * Check if the provider is available
     * (e.g., required binaries installed, keys present)
     */
    isAvailable(): Promise<boolean>;
    /**
     * Generate a new key pair
     */
    generateKeyPair(): Promise<KeyPair>;
    /**
     * Encrypt plaintext using recipient's public key
     *
     * @param plaintext - Text to encrypt
     * @param recipient - Public key of recipient
     * @returns Encrypted ciphertext (base64 or armor format)
     */
    encrypt(plaintext: string, recipient: string): Promise<string>;
    /**
     * Decrypt ciphertext using private key
     *
     * @param ciphertext - Encrypted text
     * @param privateKey - Private key for decryption (optional if using stored identity)
     * @returns Decrypted plaintext
     */
    decrypt(ciphertext: string, privateKey?: string): Promise<string>;
    /**
     * Load private key from identity file
     *
     * @param identityPath - Path to identity file
     * @returns Private key string
     */
    loadIdentity?(identityPath: string): Promise<string>;
    /**
     * Save private key to identity file
     *
     * @param privateKey - Private key to save
     * @param identityPath - Path to identity file
     */
    saveIdentity?(privateKey: string, identityPath: string): Promise<void>;
}

/**
 * Credential Service
 *
 * Main service layer for SecretSage operations.
 * Orchestrates sources, encryption, and config.
 */

/**
 * Main credential service
 */
declare class CredentialService {
    private registry;
    private localSource;
    private initialized;
    constructor();
    /**
     * Initialize the service with configured sources
     */
    init(options?: {
        local?: boolean;
    }): Promise<void>;
    /**
     * Initialize a new vault
     */
    initializeVault(options?: {
        local?: boolean;
        customPath?: string;
        passphrase?: string;
    }): Promise<{
        publicKey: string;
        vaultDir: string;
    }>;
    /**
     * Check if a vault exists
     */
    hasVault(): Promise<{
        local: boolean;
        global: boolean;
    }>;
    /**
     * Get the active vault directory path
     */
    getVaultPath(): Promise<string>;
    /**
     * Add a credential to the vault
     */
    add(name: string, value: string, metadata?: Partial<CredentialMetadata>): Promise<void>;
    /**
     * Get a credential
     */
    get(name: string): Promise<Credential | null>;
    /**
     * List all credentials
     */
    list(): Promise<CredentialMetadata[]>;
    /**
     * Delete a credential
     */
    delete(name: string): Promise<boolean>;
    /**
     * Grant credentials to .env file
     */
    grant(names: string[], options?: {
        backup?: boolean;
        envPath?: string;
    }): Promise<{
        granted: string[];
        envPath: string;
    }>;
    /**
     * Revoke credentials from .env file
     */
    revoke(names: string[]): Promise<{
        revoked: string[];
        envPath: string;
    }>;
    /**
     * Get all credentials (decrypted)
     */
    getAll(): Promise<Credential[]>;
    /**
     * Get access log for a credential
     */
    getAccessLog(name: string): Promise<{
        timestamp: Date;
        action: 'read' | 'grant';
    }[]>;
    /**
     * Add .secretsage and .env to .gitignore
     */
    updateGitignore(): Promise<boolean>;
    /**
     * Ensure service is initialized
     */
    private ensureInitialized;
    /**
     * Convert env object to string format
     */
    private stringifyEnv;
}

/**
 * Age Encryption Provider
 *
 * Implementation of IEncryptionProvider using the age-encryption npm package.
 * Age is a modern, simple encryption tool: https://age-encryption.org
 *
 * Based on typage: https://github.com/FiloSottile/typage
 */

/**
 * Age encryption provider
 *
 * Uses age-encryption npm package for X25519 + ChaCha20-Poly1305.
 * Keys are age-native format (age1... for public, AGE-SECRET-KEY-... for private).
 */
declare class AgeProvider implements IEncryptionProvider {
    readonly id = "age";
    readonly name = "age encryption";
    /**
     * Check if age encryption is available
     * (always true since we use the npm package, not CLI)
     */
    isAvailable(): Promise<boolean>;
    /**
     * Generate a new age key pair
     *
     * @returns KeyPair with age-format public and private keys
     */
    generateKeyPair(): Promise<KeyPair>;
    /**
     * Encrypt plaintext with recipient's public key
     *
     * @param plaintext - Text to encrypt
     * @param recipient - Public key (age1...)
     * @returns Base64-encoded ciphertext
     */
    encrypt(plaintext: string, recipient: string): Promise<string>;
    /**
     * Decrypt ciphertext with private key
     *
     * @param ciphertext - Base64-encoded ciphertext
     * @param privateKey - Private key (AGE-SECRET-KEY-...)
     * @returns Decrypted plaintext
     */
    decrypt(ciphertext: string, privateKey: string): Promise<string>;
    /**
     * Load private key from identity file
     *
     * @param identityPath - Path to identity file
     * @returns Private key string
     */
    loadIdentity(identityPath: string): Promise<string>;
    /**
     * Save private key to identity file
     *
     * @param privateKey - Private key to save
     * @param identityPath - Path to identity file
     */
    saveIdentity(privateKey: string, identityPath: string): Promise<void>;
    /**
     * Save public key to recipient file
     *
     * @param publicKey - Public key to save
     * @param recipientPath - Path to recipient file
     */
    saveRecipient(publicKey: string, recipientPath: string): Promise<void>;
    /**
     * Load public key from recipient file
     *
     * @param recipientPath - Path to recipient file
     * @returns Public key string
     */
    loadRecipient(recipientPath: string): Promise<string>;
    /**
     * Convert Uint8Array to base64 string
     */
    private uint8ArrayToBase64;
    /**
     * Convert base64 string to Uint8Array
     */
    private base64ToUint8Array;
}

/**
 * Local Credential Source
 *
 * Stores credentials in a local encrypted vault file.
 * Uses age encryption for secure storage.
 */

/**
 * Local credential source using age-encrypted vault
 */
declare class LocalSource implements ICredentialSource {
    readonly id = "local";
    readonly name = "Local Vault";
    readonly priority = 1;
    private encryptionProvider;
    private vaultPath;
    private identityPath;
    private recipientPath;
    constructor(options?: {
        vaultPath?: string;
        identityPath?: string;
        recipientPath?: string;
    });
    /**
     * Check if the local vault is available
     */
    isAvailable(): Promise<boolean>;
    /**
     * Initialize the local vault
     * Creates identity file and vault directory
     */
    initialize(options?: {
        passphrase?: string;
    }): Promise<void>;
    /**
     * Load identity, prompting for passphrase if protected
     * Uses caching to avoid repeated passphrase prompts
     */
    private loadIdentity;
    /**
     * Get a credential by name
     */
    get(name: string, options?: {
        action?: 'read' | 'grant';
    }): Promise<Credential | null>;
    /**
     * Log an access event to the credential's access log
     */
    private logAccess;
    /**
     * List all credential metadata
     */
    list(): Promise<CredentialMetadata[]>;
    /**
     * Store a credential
     */
    set(name: string, value: string, metadata?: Partial<CredentialMetadata>): Promise<void>;
    /**
     * Delete a credential
     */
    delete(name: string): Promise<boolean>;
    /**
     * Search credentials by pattern
     */
    search(pattern: string): Promise<CredentialMetadata[]>;
    /**
     * Get all credentials (decrypted)
     */
    getAll(): Promise<Credential[]>;
    /**
     * Get the public key (recipient)
     */
    getPublicKey(): Promise<string>;
    /**
     * Get the access log for a credential
     */
    getAccessLog(name: string): Promise<AccessLogEntry[]>;
    /**
     * Read vault entries from file
     */
    private readVault;
    /**
     * Write vault entries to file
     */
    private writeVault;
}

/**
 * Credential Source Registry
 *
 * Manages multiple credential sources with priority-based resolution.
 * Enables plugin architecture for future sources (1Password, Bitwarden, etc.)
 */

/**
 * Registry for credential sources
 *
 * Sources are resolved in priority order (lowest number = highest priority).
 * This allows fallback behavior when a credential isn't found in the
 * primary source.
 */
declare class CredentialSourceRegistry {
    private sources;
    /**
     * Register a credential source
     *
     * @param source - Credential source to register
     */
    register(source: ICredentialSource): void;
    /**
     * Unregister a credential source
     *
     * @param sourceId - ID of source to remove
     */
    unregister(sourceId: string): void;
    /**
     * Get a specific source by ID
     *
     * @param sourceId - Source ID
     * @returns Source if found, undefined otherwise
     */
    getSource(sourceId: string): ICredentialSource | undefined;
    /**
     * Get all registered sources
     */
    getAllSources(): ICredentialSource[];
    /**
     * Get available sources in priority order
     *
     * @returns Sources that are available and configured
     */
    getAvailableSources(): Promise<ICredentialSource[]>;
    /**
     * Get a credential from the first available source that has it
     *
     * @param name - Credential name
     * @returns Credential if found, null otherwise
     */
    get(name: string): Promise<Credential | null>;
    /**
     * List all credentials from all available sources
     *
     * @returns Combined list of credential metadata (deduplicated by name)
     */
    list(): Promise<CredentialMetadata[]>;
    /**
     * Set a credential in the specified source (or first writable source)
     *
     * @param name - Credential name
     * @param value - Credential value
     * @param metadata - Optional metadata to store with credential
     * @param sourceId - Optional specific source to use
     */
    set(name: string, value: string, metadata?: Partial<CredentialMetadata>, sourceId?: string): Promise<void>;
    /**
     * Delete a credential from the specified source (or all sources)
     *
     * @param name - Credential name
     * @param sourceId - Optional specific source
     * @returns true if deleted from any source
     */
    delete(name: string, sourceId?: string): Promise<boolean>;
}

/**
 * Configuration types for SecretSage
 */
/**
 * Main configuration schema
 */
interface SecretSageConfig {
    /** Config file version */
    version: string;
    /** Vault settings */
    vault: VaultConfig;
    /** Encryption settings */
    encryption: EncryptionConfig;
    /** Credential source settings */
    sources: SourceConfig[];
    /** Agent/automation settings */
    agent: AgentConfig;
}
/**
 * Vault configuration
 */
interface VaultConfig {
    /** Default vault location: 'global', 'local', or 'custom' */
    defaultLocation: 'global' | 'local' | 'custom';
    /** Custom global vault path (default: ~/.secretsage) */
    globalPath?: string;
    /** Custom local vault path (default: .secretsage) */
    localPath?: string;
    /** Custom vault path (user-specified arbitrary directory) */
    customPath?: string;
}
/**
 * Encryption configuration
 */
interface EncryptionConfig {
    /** Encryption provider: 'age' (default) */
    provider: 'age';
    /** Path to identity file (overrides default) */
    identityPath?: string;
    /** Path to recipient file (overrides default) */
    recipientPath?: string;
    /** Enable passphrase protection on identity file (scrypt) */
    passphrase?: boolean;
    /** Passphrase cache TTL in seconds (default: 300, 0 to disable) */
    passphraseCacheTTL?: number;
}
/**
 * Credential source configuration
 */
interface SourceConfig {
    /** Source type: 'local', '1password', 'bitwarden', etc. */
    type: string;
    /** Whether this source is enabled */
    enabled: boolean;
    /** Priority for resolution (lower = higher priority) */
    priority: number;
    /** Source-specific options */
    options?: Record<string, unknown>;
}
/**
 * Agent/automation configuration
 */
interface AgentConfig {
    /** Automatically add .secretsage and .env to .gitignore */
    autoGitignore: boolean;
    /** Backup .env before granting credentials */
    backupEnvOnGrant: boolean;
    /** Require confirmation for grant operations */
    requireConfirmation: boolean;
}

/**
 * Configuration loader for SecretSage
 *
 * Handles loading and merging global and local configs.
 */

/**
 * Load configuration from file
 *
 * Priority:
 * 1. Local config (.secretsage/config.yaml)
 * 2. Global config (~/.secretsage/config.yaml)
 * 3. Default config
 */
declare function loadConfig(): Promise<SecretSageConfig>;

/**
 * Get the config file path
 */
declare function getConfigPath(local?: boolean): string;

/**
 * ASCII art banner for SecretSage
 * Displayed when running `secretsage` or `secretsage --help`
 */
declare const BANNER: string;
/**
 * Compact banner for use in command output
 */
declare const COMPACT_BANNER: string;
/**
 * Print the full banner to console
 */
declare function printBanner(): void;

export { AgeProvider, BANNER, COMPACT_BANNER, type Credential, type CredentialMetadata, type CredentialScope, CredentialService, CredentialSourceRegistry, type ICredentialSource, type IEncryptionProvider, type KeyPair, LocalSource, type SecretSageConfig, getConfigPath, loadConfig, printBanner };