import { EncryptedFileSecretsStore } from "./stores/encrypted-file.js";
import { EnvSecretsStore } from "./stores/env.js";
import { KeyringSecretsStore } from "./stores/keyring.js";
import { MemorySecretsStore } from "./stores/memory.js";
import "./stores/index.js";
import { SecretsStore } from "@graphorin/core/contracts";

//#region src/secrets/factory.d.ts
/**
 * Identifier of a `SecretsStore` kind. Used by `createSecretsStore(...)`,
 * the headless detector, and the status reporter.
 *
 * @stable
 */
type SecretsStoreKind = 'auto' | 'keyring' | 'encrypted-file' | 'env' | 'memory';
/**
 * Options for `createSecretsStore(...)`.
 *
 * @stable
 */
interface CreateSecretsStoreOptions {
  /** Which store to activate. Defaults to `'auto'` (capability-matrix probe). */
  readonly kind?: SecretsStoreKind;
  /**
   * Refuse to fall back when the requested primary store is unavailable.
   * Mirrors the `--strict-secrets` CLI flag from the runtime spec.
   */
  readonly strict?: boolean;
  /**
   * Explicit fallback order for the `'auto'` chain. Defaults to
   * `['keyring', 'encrypted-file', 'env']`.
   */
  readonly fallbackChain?: ReadonlyArray<Exclude<SecretsStoreKind, 'auto'>>;
  /**
   * Optional pre-built keyring options forwarded to
   * `new KeyringSecretsStore(...)`.
   */
  readonly keyring?: ConstructorParameters<typeof KeyringSecretsStore>[0];
  /**
   * Optional pre-built env-store options.
   */
  readonly env?: ConstructorParameters<typeof EnvSecretsStore>[0];
  /**
   * Optional pre-built encrypted-file options. Required when activating
   * an encrypted-file store explicitly.
   */
  readonly encryptedFile?: ConstructorParameters<typeof EncryptedFileSecretsStore>[0];
  /**
   * Optional `MemorySecretsStore` opt-out for production-mode tests.
   */
  readonly memory?: ConstructorParameters<typeof MemorySecretsStore>[0];
  /**
   * Optional logger override. Defaults to the standard error stream;
   * the framework logger arrives in a follow-on phase.
   */
  readonly warn?: (message: string) => void;
}
/**
 * Snapshot of the active store chain - surfaces in the
 * `/v1/health/secrets` admin endpoint (consumed by the standalone
 * server) and the `graphorin doctor --check-secrets` CLI command.
 *
 * @stable
 */
interface SecretsStoreStatus {
  readonly active: Exclude<SecretsStoreKind, 'auto'>;
  readonly fallbackChain: ReadonlyArray<Exclude<SecretsStoreKind, 'auto'>>;
  readonly downgradedFrom?: Exclude<SecretsStoreKind, 'auto'>;
  readonly downgradeReason?: string;
  readonly strictMode: boolean;
  readonly headless: boolean;
  readonly headlessReasons: ReadonlyArray<string>;
}
/**
 * Read the status of the currently-active `SecretsStore`. Returns
 * `undefined` if `createSecretsStore(...)` has not been called yet.
 *
 * @stable
 */
declare function getSecretsStoreStatus(): SecretsStoreStatus | undefined;
/**
 * Read the currently-active store. Returns `undefined` if
 * `createSecretsStore(...)` has not been called yet.
 *
 * @stable
 */
declare function getActiveSecretsStore(): SecretsStore | undefined;
/**
 * Reset internal state. Tests use this between cases.
 *
 * @experimental
 */
declare function _resetSecretsFactoryForTesting(): void;
/**
 * Detect whether the host is "headless" - that is, no interactive
 * terminal is attached and the process is likely running unattended.
 * The result drives the `'auto'` chain's keyring vs. encrypted-file
 * decision.
 *
 * @stable
 */
declare function detectHeadless(): {
  headless: boolean;
  reasons: ReadonlyArray<string>;
};
/**
 * Compose multiple stores into a try-in-order chain. The first non-null
 * value wins; writes go to the first writable store.
 *
 * @stable
 */
declare function composeChain(stores: ReadonlyArray<SecretsStore>): SecretsStore;
/**
 * Parse the `GRAPHORIN_SECRETS_SOURCE` env value (per the documented
 * `--secrets-source` flag policy). Accepts a single store kind
 * (`'keyring'`, `'encrypted-file'`, `'env'`, `'memory'`, `'auto'`) or
 * a comma-separated chain (e.g. `'keyring,encrypted-file'`). Returns
 * `undefined` when the env is unset.
 *
 * @stable
 */
declare function parseSecretsSourceEnv(raw: string | undefined): {
  kind: SecretsStoreKind;
  fallbackChain?: ReadonlyArray<Exclude<SecretsStoreKind, 'auto'>>;
} | undefined;
/**
 * Activate a `SecretsStore` for the current process. The result is
 * cached; subsequent calls overwrite the previous active store and
 * re-wire the `ref:` resolver.
 *
 * @stable
 */
declare function createSecretsStore(opts?: CreateSecretsStoreOptions): Promise<SecretsStore>;
//#endregion
export { CreateSecretsStoreOptions, SecretsStoreKind, SecretsStoreStatus, _resetSecretsFactoryForTesting, composeChain, createSecretsStore, detectHeadless, getActiveSecretsStore, getSecretsStoreStatus, parseSecretsSourceEnv };
//# sourceMappingURL=factory.d.ts.map