/**
 * Ansible Vault Secrets
 *
 * Read, write, and check secrets stored in an Ansible Vault–encrypted YAML file.
 * Uses pure Node.js encryption (ansible-vault npm package) — no Python/CLI required.
 */
export interface AnsibleVaultSecretsConfig {
    /** Path to the vault file (relative to rootDir or absolute) */
    vault_path: string;
    /** Optional path to file containing vault password */
    vault_password_file?: string;
    /** Root directory for resolving relative vault_path */
    rootDir?: string;
}
export interface SetSecretResult {
    success: boolean;
    error?: string;
}
export interface CheckSecretsResult {
    status?: Record<string, boolean>;
    missing?: string[];
    error?: string;
}
/**
 * Resolve the vault password for use with ansible-vault.
 *
 * Supports three storage formats, tried in order:
 *   1. ANSIBLE_VAULT_PASSWORD env var (plaintext, CI-friendly)
 *   2. STACK_VAULT_PASSPHRASE env var unwrapping a STACKVAULT1-headed file
 *   3. ~/.vault_pass on disk:
 *      - if first line is "STACKVAULT1": prompt the user for their passphrase
 *        and unwrap the inner ansible password (scrypt + AES-GCM)
 *      - otherwise: treat as legacy plaintext, and on first encounter offer
 *        to encrypt it now (gated by interactive TTY + no opt-out marker)
 *
 * Within a single process, the unwrapped password is cached so subsequent
 * calls don't re-prompt.
 */
export declare function getVaultPasswordString(config: AnsibleVaultSecretsConfig): Promise<string>;
/**
 * Vault content structure supporting nested environment secrets
 */
export interface VaultContent {
    STAGING_SSH?: string;
    PROD_SSH?: string;
    AWS_SECRET_ACCESS_KEY?: string;
    staging_envs?: Record<string, string>;
    prod_envs?: Record<string, string>;
    [key: string]: string | Record<string, string> | undefined;
}
/**
 * Ansible Vault–backed secret operations.
 * Uses pure Node.js encryption (no CLI). Password from config or ANSIBLE_VAULT_PASSWORD_FILE / ANSIBLE_VAULT_PASSWORD.
 */
export declare class AnsibleVaultSecrets {
    private config;
    constructor(config: AnsibleVaultSecretsConfig);
    /**
     * Ensure vault file exists; if not, create an empty encrypted file
     */
    private ensureVaultExists;
    /**
     * Get decrypted vault content as key-value object (flat, for backwards compatibility)
     */
    private getDecrypted;
    /**
     * Get decrypted vault content as full structure (supports nested objects)
     */
    private getDecryptedFull;
    /**
     * Save vault content (full structure)
     */
    private saveVault;
    /**
     * Set a secret in the vault file
     */
    setSecret(name: string, value: string): Promise<SetSecretResult>;
    /**
     * Get a secret value from the vault
     */
    getSecret(name: string): Promise<string | null>;
    /**
     * Delete a secret from the vault
     */
    deleteSecret(name: string): Promise<SetSecretResult>;
    /**
     * Delete an environment secret from the vault
     */
    deleteEnvironmentSecret(stage: 'staging' | 'prod', name: string): Promise<SetSecretResult>;
    /**
     * Check which of the given secret names exist in the vault
     */
    checkSecrets(names: string[]): Promise<CheckSecretsResult>;
    /**
     * Get SSH key for a stage
     */
    getSSHKey(stage: 'staging' | 'prod'): Promise<string | null>;
    /**
     * Get all environment secrets for a stage
     */
    getEnvironmentSecrets(stage: 'staging' | 'prod'): Promise<Record<string, string>>;
    /**
     * Set an environment secret for a stage
     */
    setEnvironmentSecret(stage: 'staging' | 'prod', name: string, value: string): Promise<SetSecretResult>;
    /**
     * Set multiple environment secrets for a stage at once
     */
    setEnvironmentSecrets(stage: 'staging' | 'prod', secrets: Record<string, string>): Promise<SetSecretResult>;
    /**
     * List all environment secret keys for a stage (not values)
     */
    listEnvironmentSecretKeys(stage: 'staging' | 'prod'): Promise<string[]>;
    /**
     * Check if environment secrets exist for a stage
     */
    hasEnvironmentSecrets(stage: 'staging' | 'prod'): Promise<boolean>;
}
//# sourceMappingURL=ansible-vault-secrets.d.ts.map