/**
 * Secrets Service
 *
 * High-level service for managing workspace secrets.
 * Provides CRUD operations and runtime secret resolution.
 */
import { EnvType, IRequestExtension } from '../types';
import { ICreateSecretInput, IUpdateSecretInput, ISecret, ISecretMetadata, ISecretsServiceConfig, IResolveSecretsOptions, ISecretResolutionResult } from './secrets.types';
export interface ISecretsServiceDeps {
    environment: EnvType;
    getAuth: () => IRequestExtension;
    getPrivateKey: () => string | undefined;
}
export declare class SecretsService {
    private apiService;
    private getAuth;
    private getPrivateKey;
    private resolver;
    private config;
    private encryptedCache;
    private cacheTtl;
    constructor(deps: ISecretsServiceDeps, config?: ISecretsServiceConfig);
    /**
     * Encrypt a value using the workspace's private key
     * Uses AES-256-GCM for symmetric encryption
     */
    private encryptValue;
    /**
     * Create a new secret
     */
    create(input: ICreateSecretInput): Promise<ISecretMetadata>;
    /**
     * Fetch all secrets (metadata only, no values)
     */
    fetchAll(): Promise<ISecretMetadata[]>;
    /**
     * Fetch a single secret with decrypted value
     * Uses ultra-secure flow: fetches encrypted value, caches it, decrypts locally
     */
    fetch(key: string): Promise<ISecret>;
    /**
     * Update an existing secret
     */
    update(key: string, input: IUpdateSecretInput): Promise<ISecretMetadata>;
    /**
     * Delete a secret permanently
     */
    delete(key: string): Promise<boolean>;
    /**
     * Revoke a secret (disable without deleting)
     */
    revoke(key: string): Promise<boolean>;
    /**
     * Check if a key exists in the workspace
     */
    exists(key: string): Promise<boolean>;
    /**
     * Resolve all $Secret{key} patterns in a value
     * Works with strings, objects, and arrays
     */
    resolve<T>(value: T, options?: IResolveSecretsOptions): Promise<ISecretResolutionResult<T>>;
    /**
     * Resolve a single string value
     */
    resolveString(value: string, options?: IResolveSecretsOptions): Promise<ISecretResolutionResult<string>>;
    /**
     * Check if a value is a secret reference
     */
    isSecretReference(value: string): boolean;
    /**
     * Check if a value might contain secrets
     */
    mightContainSecrets(value: unknown): boolean;
    /**
     * Find all secret keys referenced in a value
     */
    findAllSecretReferences(value: unknown): string[];
    /**
     * Validate that all referenced secrets exist
     * Useful for validation during asset creation/update
     */
    validateSecretReferences(value: unknown): Promise<{
        valid: boolean;
        missingKeys: string[];
        existingKeys: string[];
    }>;
    /**
     * Clear the internal caches (both decrypted resolver cache and encrypted cache)
     */
    clearCache(): void;
}
export declare function getSecretsService(): SecretsService | null;
export declare function setSecretsService(service: SecretsService): void;