import type { StoreStatus, StoreInitResult } from '../types/init-result.js';
import type { ClusterLocalBackend } from '@generacy-ai/credhelper';
import type { AppConfigFileStore } from './app-config-file-store.js';
export interface RenderResult {
    rendered: string[];
    failed: string[];
}
/**
 * Atomic read-modify-write store for app-config secret environment variables.
 * Maintains a secrets.env file on tmpfs as a derived view of the encrypted backend.
 * Mirrors AppConfigEnvStore pattern: fallback chain, atomic writes, promise-chain mutex.
 */
export declare class AppConfigSecretEnvStore {
    private readonly backend;
    private readonly fileStore;
    private envPath;
    private writeChain;
    private status;
    private disabledReason?;
    constructor(backend: ClusterLocalBackend, fileStore: AppConfigFileStore, envPath?: string);
    init(): Promise<void>;
    getStatus(): StoreStatus;
    getInitResult(): StoreInitResult;
    /**
     * Boot-time full render: walk metadata for secret entries, unseal each,
     * write combined file. Best-effort: skip entries that fail to unseal.
     */
    renderAll(): Promise<RenderResult>;
    /** Set a secret env var. Atomic rewrite under advisory lock. */
    set(name: string, value: string): Promise<void>;
    /** Delete a secret env var. Returns true if it existed, false otherwise. */
    delete(name: string): Promise<boolean>;
    /** List all secret env var names and their values. */
    list(): Promise<Map<string, string>>;
    private readAll;
    private writeAll;
    private withLock;
}
//# sourceMappingURL=app-config-secret-env-store.d.ts.map