/**
 * Canonical Fjall secrets namespace module — the single source of truth for
 * the SSM Parameter Store hierarchy shared by the CLI, the CDK constructs,
 * the generator, and the webapp:
 *
 *   /<app>/<NAME>                        app-root secrets
 *   /<app>/<cluster>/<NAME>              cluster secrets
 *   /<app>/<cluster>/<service>/<NAME>    service secrets
 *   /<app>/lambda/<function>/<NAME>      lambda secrets
 *
 * Browser-safe by contract: no Node built-ins (no `Buffer`, no `node:fs`) —
 * this module is exported from the `@fjall/util` barrel, which client bundles
 * import.
 */
import { z } from "zod";
export declare const SECRET_NAME_PATTERN: RegExp;
export declare const SECRET_NAME_ERROR = "Secret name must start with a letter or underscore and contain only letters, numbers, underscores, hyphens, or periods";
export declare const SSM_COMPONENT_PATTERN: RegExp;
export declare const SSM_COMPONENT_ERROR = "Must start with a letter and contain only letters, numbers, periods, hyphens, or underscores";
/** SSM Standard-tier parameter values are capped at 4 KB of UTF-8 bytes, not characters. */
export declare const SSM_STANDARD_MAX_VALUE_BYTES = 4096;
/**
 * Namespace for a secret's location in the hierarchy. Service requires
 * cluster; lambda is mutually exclusive with cluster/service; the cluster
 * name "lambda" is reserved because it is the path marker for lambda scope.
 */
export declare const SecretNamespaceSchema: z.ZodObject<{
    app: z.ZodString;
    cluster: z.ZodOptional<z.ZodString>;
    service: z.ZodOptional<z.ZodString>;
    lambda: z.ZodOptional<z.ZodString>;
}, z.core.$strict>;
export type SecretNamespace = z.infer<typeof SecretNamespaceSchema>;
/**
 * Build the ordered path segments for a namespace. A service without a
 * cluster is dropped (that shape is not encodable in the hierarchy — the
 * schema rejects it).
 */
export declare function buildNamespaceParts(ns: SecretNamespace): string[];
/**
 * Build the full SSM parameter path from a namespace and optional secret
 * name. Without a name, returns the namespace root path.
 */
export declare function buildParameterPath(namespace: SecretNamespace, name?: string): string;
/**
 * Parse a full SSM parameter path into namespace and secret name — the
 * inverse of buildParameterPath. Returns null for paths with fewer than two
 * segments.
 *
 * Lambda decode requires four segments: the 3-segment `/app/lambda/NAME`
 * shape deliberately decodes as cluster "lambda" (not a lambda scope), so
 * the reserved-cluster refine marks it unmanageable instead of NAME being
 * mistaken for a function name.
 */
export declare function parseParameterPath(fullPath: string): {
    namespace: SecretNamespace;
    name: string;
} | null;
/**
 * Whether a parameter path is manageable through Fjall's namespace
 * hierarchy: it decodes to a schema-valid namespace AND rebuilding the path
 * from the decoded parts reproduces it exactly. False for paths outside the
 * convention (five-plus segments, the reserved 3-segment `/app/lambda/NAME`
 * shape) — a mutation rebuilt from such a path's namespace would target a
 * DIFFERENT parameter.
 */
export declare function isManageablePath(fullPath: string): boolean;
/**
 * Parse .env file contents into key-value pairs. Handles single- and
 * double-quoted values, the `export KEY=value` dialect, comments, and empty
 * lines; keys failing SECRET_NAME_PATTERN are skipped.
 *
 * Double-quoted values unescape exactly the sequence set escapeDotEnvValue
 * emits, so an exported file re-imports to the original values. Single-quoted
 * and bare values stay literal.
 *
 * **Limitation**: raw multiline values are not supported — an unquoted value
 * containing literal newlines (private keys, certificates) is truncated at
 * the first newline. Exported files are unaffected: escapeDotEnvValue encodes
 * newlines as `\n`, which double-quoted parsing restores.
 */
export declare function parseDotEnv(content: string): Record<string, string>;
/**
 * Escape a value for double-quoted dotenv output. Backslash is replaced
 * first — later replacements introduce backslashes that must not be
 * re-escaped. parseDotEnv reverses exactly this sequence set for
 * double-quoted values, making export → import a lossless round trip.
 */
export declare function escapeDotEnvValue(value: string): string;