/**
 * Secrets Types
 *
 * Type definitions for the workspace secrets system that allows
 * users to reference secrets using $Secret{key} syntax.
 */
/**
 * Regex pattern to detect $Secret{key} or $secret{key} syntax (full string match)
 * Matches: $Secret{my-key}, $secret{api_key}, $Secret{DB_PASSWORD}
 */
export declare const SECRET_PATTERN: RegExp;
/**
 * Regex pattern to find all $Secret{key} or $secret{key} occurrences in a string
 */
export declare const SECRET_PATTERN_GLOBAL: RegExp;
/**
 * Token type for secrets
 */
export type SecretTokenType = 'api' | 'access' | 'credential' | 'bearer' | 'oauth';
/**
 * Input for creating a new secret
 */
export interface ICreateSecretInput {
    /** Unique identifier for the secret */
    key: string;
    /** The secret value (will be encrypted) */
    value: string;
    /** Human-readable description */
    description?: string;
    /** Type of token: 'api' or 'access' */
    token_type?: SecretTokenType;
    /** Array of app tags this secret can be used with */
    scope?: string[];
    /** Array of environment slugs where this secret is available */
    envs?: string[];
    /** Unix timestamp for expiration (null = no expiry) */
    expires_at?: number | null;
}
/**
 * Input for updating an existing secret
 */
export interface IUpdateSecretInput {
    /** New secret value (will be re-encrypted) */
    value?: string;
    /** Updated description */
    description?: string;
    /** Updated token type */
    token_type?: SecretTokenType;
    /** Updated scope array */
    scope?: string[];
    /** Updated environments array */
    envs?: string[];
    /** Updated expiration timestamp */
    expires_at?: number | null;
}
/**
 * Secret metadata (returned from list operations - no value)
 */
export interface ISecretMetadata {
    /** MongoDB ObjectId */
    _id: string;
    /** Workspace ID */
    workspace_id: string;
    /** Unique key/identifier */
    key: string;
    /** Human-readable description */
    description?: string;
    /** Type of token */
    token_type?: SecretTokenType;
    /** Array of app tags this secret can be used with */
    scope?: string[];
    /** Array of environment slugs */
    envs?: string[];
    /** Unix timestamp for expiration */
    expires_at?: number | null;
    /** Whether the secret has been revoked */
    revoked?: boolean;
    /** Creation timestamp */
    createdAt: string;
    /** Last update timestamp */
    updatedAt: string;
}
/**
 * Full secret including decrypted value (returned from fetch)
 */
export interface ISecret extends ISecretMetadata {
    /** Decrypted secret value */
    value: string;
}
/**
 * Result of checking if a value is a secret reference
 */
export interface ISecretCheck {
    /** Whether the value is a secret reference */
    isSecret: boolean;
    /** The secret key if it's a secret reference */
    key?: string;
}
/**
 * Options for resolving secrets at runtime
 */
export interface IResolveSecretsOptions {
    /** Current app tag (for scope validation) */
    app?: string;
    /** Current environment slug (for env validation) */
    env?: string;
}
/**
 * Result of secret resolution
 */
export interface ISecretResolutionResult<T = unknown> {
    /** The resolved value with secrets replaced */
    value: T;
    /** Keys that were resolved */
    resolvedKeys: string[];
    /** Keys that failed to resolve */
    failedKeys: string[];
}
/**
 * Configuration for the secrets service
 */
export interface ISecretsServiceConfig {
    /** Cache TTL in milliseconds (default: 5 minutes) */
    cacheTtl?: number;
    /** Whether to throw on missing secrets or return the original value */
    throwOnMissing?: boolean;
}
/**
 * Secrets service interface
 */
export interface ISecretsService {
    /** Create a new secret */
    create(input: ICreateSecretInput): Promise<ISecretMetadata>;
    /** Fetch all secrets (metadata only) */
    fetchAll(): Promise<ISecretMetadata[]>;
    /** Fetch a single secret with decrypted value */
    fetch(key: string): Promise<ISecret>;
    /** Update an existing secret */
    update(key: string, input: IUpdateSecretInput): Promise<ISecretMetadata>;
    /** Delete a secret */
    delete(key: string): Promise<boolean>;
    /** Revoke a secret (disable without deleting) */
    revoke(key: string): Promise<boolean>;
}
/**
 * Error thrown when a secret is not found
 */
export declare class SecretNotFoundError extends Error {
    readonly key: string;
    constructor(key: string);
}
/**
 * Error thrown when secret scope doesn't match
 */
export declare class SecretScopeError extends Error {
    readonly key: string;
    readonly app: string;
    constructor(key: string, app: string);
}
/**
 * Error thrown when secret environment doesn't match
 */
export declare class SecretEnvironmentError extends Error {
    readonly key: string;
    readonly env: string;
    constructor(key: string, env: string);
}
/**
 * Error thrown when secret has expired
 */
export declare class SecretExpiredError extends Error {
    readonly key: string;
    constructor(key: string);
}
/**
 * Error thrown when secret has been revoked
 */
export declare class SecretRevokedError extends Error {
    readonly key: string;
    constructor(key: string);
}
/**
 * Error thrown when secret resolution fails
 */
export declare class SecretResolutionError extends Error {
    readonly failedKeys: string[];
    constructor(message: string, failedKeys: string[]);
}