import { KeyObject } from 'node:crypto';
export type CredentialIssuanceMode = 'ephemeral' | 'durable';
export type CustodyStage = 'issue' | 'store' | 'retrieve' | 'verify' | 'activate' | 'record' | 'inject' | 'revoke' | 'reconcile';
export declare class CustodyError extends Error {
    readonly code: string;
    readonly stage: CustodyStage;
    readonly details?: Readonly<Record<string, unknown>>;
    constructor(code: string, stage: CustodyStage, message: string, options?: {
        cause?: unknown;
        details?: Record<string, unknown>;
    });
    toJSON(): Record<string, unknown>;
}
export declare class SecretMaterial {
    #private;
    private constructor();
    static fromString(value: string): SecretMaterial;
    get destroyed(): boolean;
    use(operation: (value: string) => void | Promise<void>): Promise<void>;
    destroy(): void;
    toJSON(): string;
    toString(): string;
}
export interface CredentialIssueRequest {
    mode: CredentialIssuanceMode;
    subject: string;
    expiresAt?: string;
    metadata?: Readonly<Record<string, string>>;
}
export interface IssuedCredential {
    credentialId: string;
    secret: SecretMaterial;
    issuedAt?: string;
    expiresAt?: string;
}
export interface CredentialIssuer {
    readonly name: string;
    issue(request: CredentialIssueRequest): Promise<IssuedCredential>;
    /** Must be idempotent so failed custody transitions can be retried. */
    revoke(credentialId: string, reason: string): Promise<void>;
}
export interface CredentialVerifier {
    readonly name: string;
    verify(input: {
        credentialId: string;
        secret: SecretMaterial;
    }): Promise<{
        verified: boolean;
        verificationId?: string;
    }>;
}
export interface SecretSinkRecord {
    sinkName: string;
    reference: string;
    version: string;
    storedAt: string;
}
export interface SecretSinkInventoryEntry extends SecretSinkRecord {
    credentialId: string;
}
export interface CredentialSecretSink {
    readonly name: string;
    store(input: {
        credentialId: string;
        secret: SecretMaterial;
        metadata: Readonly<Record<string, string>>;
    }): Promise<SecretSinkRecord>;
    retrieve(record: SecretSinkRecord): Promise<SecretMaterial>;
    /**
     * Removes any write for this credential, including a store that persisted
     * data but failed before returning its record. Must be idempotent.
     */
    removeByCredentialId(credentialId: string, reason: string): Promise<void>;
    /** Must conditionally remove this exact version and be idempotent. */
    remove(record: SecretSinkRecord, reason: string): Promise<void>;
    inventory(): Promise<SecretSinkInventoryEntry[]>;
}
export interface CustodyAttribution {
    actor: string;
    runtime: string;
    session: string;
}
export interface CustodyReceipt {
    receiptId: string;
    mode: CredentialIssuanceMode;
    credentialId: string;
    subject: string;
    issuer: string;
    verifier: string;
    verificationId?: string;
    verificationState: 'verified';
    issuedAt: string;
    verifiedAt: string;
    expiresAt?: string;
    sink?: SecretSinkRecord;
    replacesReceiptId?: string;
    rotationRootReceiptId: string;
    attribution: CustodyAttribution;
    metadata: Readonly<Record<string, string>>;
    finalizer: string;
    finalizationId: string;
    attestation: CustodyReceiptAttestation;
}
export interface CustodyReceiptAttestation {
    algorithm: 'Ed25519';
    attestor: string;
    keyId: string;
    signature: string;
}
export interface CredentialReceiptAttestor {
    readonly name: string;
    readonly keyId: string;
    attest(payload: string): Promise<string>;
}
export interface CredentialCustodyFinalizer {
    readonly name: string;
    prepare(input: {
        receipt: CustodyReceipt;
        secret: SecretMaterial;
    }): Promise<{
        prepared: boolean;
    }>;
    commit(input: {
        receipt: CustodyReceipt;
    }): Promise<void>;
    abort(input: {
        receipt: CustodyReceipt;
        reason: string;
    }): Promise<void>;
    status(input: {
        receipt: CustodyReceipt;
    }): Promise<'missing' | 'prepared' | 'committed' | 'aborted'>;
}
export declare class Ed25519CustodyReceiptAttestor implements CredentialReceiptAttestor {
    #private;
    readonly name: string;
    readonly keyId: string;
    constructor(options: {
        privateKey: KeyObject;
        keyId: string;
        name?: string;
    });
    attest(payload: string): Promise<string>;
}
export type CustodyEventType = 'issued' | 'revoked' | 'expired' | 'replaced' | 'rollback-pending' | 'rollback-complete' | 'finalization-pending' | 'retirement-pending' | 'retirement-complete' | 'orphan-detected' | 'orphan-removed';
export interface CustodyEvent {
    eventId: string;
    type: CustodyEventType;
    occurredAt: string;
    receiptId?: string;
    recoveryId?: string;
    credentialId?: string;
    requiresSink?: boolean;
    finalizationReceipt?: CustodyReceipt;
    recoveryReceipt?: CustodyReceipt;
    replacementReceiptId?: string;
    sinkReference?: string;
    reason?: string;
}
export interface CustodyLedger {
    /**
     * Atomically records a receipt and its finalization-pending event.
     * Implementations must reject duplicate receipt IDs, terminal predecessors,
     * a second child for the same replacesReceiptId, and any other event type.
     */
    recordIssuance(receipt: CustodyReceipt, event: CustodyEvent): Promise<void>;
    /**
     * Idempotently appends the issued event and optional retirement-pending
     * followup in one transaction. No other event types are accepted.
     */
    commitIssuance(receiptId: string, event: CustodyEvent, followup?: CustodyEvent): Promise<void>;
    /**
     * Idempotently appends an event by eventId. Replaying the same event must
     * succeed; reusing an eventId for different content must fail closed.
     */
    appendEvent(event: CustodyEvent): Promise<void>;
    listReceipts(): Promise<CustodyReceipt[]>;
    listEvents(): Promise<CustodyEvent[]>;
}
export declare class InMemoryCustodyLedger implements CustodyLedger {
    #private;
    recordIssuance(receipt: CustodyReceipt, event: CustodyEvent): Promise<void>;
    appendEvent(event: CustodyEvent): Promise<void>;
    commitIssuance(receiptId: string, event: CustodyEvent, followup?: CustodyEvent): Promise<void>;
    listReceipts(): Promise<CustodyReceipt[]>;
    listEvents(): Promise<CustodyEvent[]>;
}
export interface CredentialLease {
    readonly receipt: CustodyReceipt;
    withEnvironment(variableName: string, operation: () => void | Promise<void>): Promise<void>;
    withChildProcess(options: CredentialChildProcessOptions): Promise<CredentialChildProcessResult>;
    revoke(reason?: string): Promise<void>;
}
export interface CredentialChildProcessOptions {
    /**
     * Acknowledges that the command and every credential-bearing descendant are
     * trusted to remain in the SDK-owned POSIX process group.
     */
    trust: 'cooperative-process-group';
    command: string;
    args?: readonly string[];
    environmentVariable: string;
    environment?: Readonly<Record<string, string>>;
    cwd?: string;
    timeoutMs?: number;
    maxOutputBytes?: number;
}
export interface CredentialChildProcessResult {
    exitCode: number | null;
    signal: NodeJS.Signals | null;
    stdout: string;
    stderr: string;
    timedOut: boolean;
}
export interface CustodyReconciliation {
    checkedAt: string;
    orphaned: SecretSinkInventoryEntry[];
    missing: CustodyReceipt[];
}
export interface CredentialCustodyOptions {
    issuer: CredentialIssuer;
    verifier: CredentialVerifier;
    ledger: CustodyLedger;
    attestor: CredentialReceiptAttestor;
    finalizer: CredentialCustodyFinalizer;
    sink?: CredentialSecretSink;
    ephemeralTtlMs?: number;
    ephemeralRevokeRetryMs?: number;
    orphanGraceMs?: number;
    finalizationTakeoverMs?: number;
    now?: () => Date;
    onBackgroundError?: (error: CustodyError) => void;
}
export interface CustodyIssuanceRequest {
    mode: CredentialIssuanceMode;
    subject: string;
    attribution: CustodyAttribution;
    expiresAt?: string;
    metadata?: Readonly<Record<string, string>>;
    replacesReceiptId?: string;
}
export declare class CredentialCustody {
    #private;
    constructor(options: CredentialCustodyOptions);
    issue(request: CustodyIssuanceRequest): Promise<CredentialLease>;
    rotate(receiptId: string, request: Omit<CustodyIssuanceRequest, 'mode' | 'replacesReceiptId'>): Promise<CredentialLease>;
    revoke(receiptId: string, reason?: string): Promise<void>;
    recoverPendingRollbacks(): Promise<void>;
    recoverCredential(credentialId: string, options?: {
        requiresSink?: boolean;
    }): Promise<void>;
    reconcile(): Promise<CustodyReconciliation>;
    recoverOrphans(report: CustodyReconciliation): Promise<void>;
}
export declare function withEnvironmentSecret(material: SecretMaterial, variableName: string, operation: () => void | Promise<void>, bounds?: {
    expiresAt?: string;
}): Promise<void>;
export declare function runCredentialChildProcess(material: SecretMaterial, options: CredentialChildProcessOptions, bounds?: {
    expiresAt?: string;
}): Promise<CredentialChildProcessResult>;
export declare function verifyCustodyReceiptAttestation(receipt: CustodyReceipt, material: SecretMaterial, publicKey: KeyObject): Promise<boolean>;
export declare function redactCredentialText(input: string, knownSecrets?: readonly string[]): string;
export declare function redactCredentialValues(value: unknown, knownSecrets?: readonly string[]): unknown;
//# sourceMappingURL=custody.d.ts.map