import * as plugins from '../plugins.js';
import type { TSha256Digest } from './immutableimage.js';
export type TSecretEnvironment = string;
export type TSecretLifecycleState = 'active' | 'retired' | 'revoked' | 'deleted';
export type TSecretVersionLifecycleState = 'active' | 'retired' | 'revoked' | 'purge-pending' | 'purged';
/** Retired versions remain usable only through an already-accepted manifest. */
export declare const isSecretVersionMaterialIssuable: (lifecycleStateArg: TSecretVersionLifecycleState, referencedByAcceptedManifestArg: boolean) => boolean;
export type TSecretManagementSource = 'operator' | 'appstore' | 'mail' | 'oidc' | 'webpush' | 'platform' | 'system';
export type TSecretManagementScope = 'operator' | `appstore:${string}` | `mail:${string}` | `oidc:${string}` | `webpush:${string}` | `platform:${string}` | `system:${string}`;
export interface IServiceSecretOwner {
    kind: 'service';
    serviceId: string;
}
export interface ISecretSetSecretOwner {
    kind: 'secret-set';
    secretSetId: string;
}
export interface IPlatformProviderSecretOwner {
    kind: 'platform-provider';
    providerConfigId: string;
}
export interface ISystemSecretOwner {
    kind: 'system';
    systemId: string;
}
export type TSecretOwner = IServiceSecretOwner | ISecretSetSecretOwner | IPlatformProviderSecretOwner | ISystemSecretOwner;
export type TSecretMutationTarget = TSecretOwner;
export type TWorkloadSecretOwner = IServiceSecretOwner | ISecretSetSecretOwner;
export interface ISecretVersionReference {
    secretId: string;
    secretVersionId: string;
}
export type TSecretVersionRetentionReferenceKind = 'desired-manifest' | 'applied-manifest' | 'previous-accepted-manifest' | 'rollback-manifest' | 'backup' | 'retention-window';
export interface ISecretVersionRetentionReference {
    kind: TSecretVersionRetentionReferenceKind;
    resourceId: string;
    expiresAt?: number;
}
export declare const secretVersionRetentionReferenceLimits: Readonly<{
    pageSizeMaximum: 256;
}>;
/** Browser-safe logical secret metadata. It never contains value material. */
export interface ISecretMetadata {
    id: string;
    organizationId: string;
    owner: TSecretOwner;
    key: string;
    environment: TSecretEnvironment;
    name: string;
    description?: string;
    tags: Array<{
        key: string;
        value: string;
    }>;
    managementSource: TSecretManagementSource;
    /** Exact reconciliation owner, for example operator or appstore:<appId>. */
    managementScope: TSecretManagementScope;
    defaultDelivery: TSecretDelivery;
    lifecycleState: TSecretLifecycleState;
    activeVersion?: ISecretVersionReference;
    versionCount: number;
    revision: number;
    createdAt: number;
    updatedAt: number;
    lastRotatedAt?: number;
}
/** Browser-safe immutable-version metadata. It never contains an encrypted envelope. */
export interface ISecretVersionMetadata {
    id: string;
    secretId: string;
    revision: number;
    lifecycleState: TSecretVersionLifecycleState;
    createdAt: number;
    createdBy: string;
    source: TSecretManagementSource;
    retiredAt?: number;
    revokedAt?: number;
    purgeOperationId?: string;
    purgedAt?: number;
}
/** Irreversibly erases every platform-managed copy after all references are gone. */
export interface ISecretVersionPurgeIntentV1 {
    schemaVersion: 1;
    mutationId: string;
    secretId: string;
    secretVersionId: string;
    expectedSecretRevision: number;
    expectedSecretVersionRevision: number;
    expectedTargetSecretsRevision: number;
}
export interface ISecretVersionPurgeFailureV1 {
    code: string;
    retryable: boolean;
    failedAt: number;
}
interface ISecretVersionPurgeOperationBaseV1 {
    schemaVersion: 1;
    id: string;
    revision: number;
    intent: ISecretVersionPurgeIntentV1;
    intentDigest: TSha256Digest;
    createdAt: number;
    updatedAt: number;
}
export type TSecretVersionPurgeOperationV1 = (ISecretVersionPurgeOperationBaseV1 & {
    state: 'pending' | 'erasing';
    failure?: never;
    purgedAt?: never;
}) | (ISecretVersionPurgeOperationBaseV1 & {
    state: 'failed';
    failure: ISecretVersionPurgeFailureV1;
    purgedAt?: never;
}) | (ISecretVersionPurgeOperationBaseV1 & {
    state: 'succeeded';
    failure?: never;
    purgedAt: number;
});
export interface ISecretSetMetadata {
    id: string;
    organizationId: string;
    name: string;
    description?: string;
    lifecycleState: 'active' | 'retired' | 'deleted';
    revision: number;
    /** Dedicated CAS revision for secrets owned by this set. */
    secretsRevision: number;
    currentConsumerRollout?: ISecretSetConsumerRolloutSummary;
    createdAt: number;
    updatedAt: number;
}
export type TSecretSetConsumerRolloutStatus = 'pending' | 'published' | 'applied' | 'failed';
export interface ISecretSetConsumerRolloutSummary {
    rolloutId: string;
    secretId: string;
    secretVersionId: string;
    totalConsumers: number;
    pendingConsumers: number;
    failedConsumers: number;
    updatedAt: number;
}
export interface ISecretSetConsumerRolloutStatus {
    serviceId: string;
    status: TSecretSetConsumerRolloutStatus;
    desiredManifestIds: string[];
    appliedManifestIds: string[];
    errorCode?: string;
    updatedAt: number;
}
export interface ISecretLauncherEnvironmentDelivery {
    type: 'launcher-environment';
    variableName: string;
    uid: number;
    gid: number;
    mode: 0o400 | 0o440;
}
export interface ISecretFileDelivery {
    type: 'file';
    targetPath: string;
    uid: number;
    gid: number;
    mode: 0o400 | 0o440;
}
export type TSecretDelivery = ISecretLauncherEnvironmentDelivery | ISecretFileDelivery;
export declare const secretValueLimits: Readonly<{
    maximumBytes: number;
    minimumGeneratedBytes: 16;
    maximumGeneratedBytes: 64;
}>;
export type TSecretGeneratedEncoding = 'hex' | 'base64url';
export type TSecretValueInput = {
    mode: 'sealed';
    envelope: plugins.smartcrypto.IX25519EnvelopeV1;
} | {
    mode: 'generated';
    encoding: TSecretGeneratedEncoding;
    bytes: number;
};
export interface ISecretSetAttachmentMapping {
    /** Source key in the attached SecretSet. */
    sourceKey: string;
    /** Final service key. Defaults to sourceKey. */
    targetKey?: string;
    /** Optional service-specific delivery override. */
    delivery?: TSecretDelivery;
}
export interface ISecretSetAttachment {
    id: string;
    secretSetId: string;
    environment: TSecretEnvironment;
    mappings?: ISecretSetAttachmentMapping[];
}
/**
 * Caller-managed value-free inputs to service secret resolution.
 * Cloudly verifies organization ownership when resolving the referenced sets.
 */
export interface IServiceSecretConfiguration {
    schemaVersion: 2;
    /** Dedicated CAS revision for SecretSet attachments. */
    revision: number;
    /** Dedicated CAS revision for service-owned secret membership. */
    secretsRevision: number;
    secretSetAttachments: ISecretSetAttachment[];
}
export interface IResolvedSecretManifestEntry {
    secretId: string;
    secretVersionId: string;
    key: string;
    environment: TSecretEnvironment;
    owner: TWorkloadSecretOwner;
    delivery: TSecretDelivery;
}
/** Immutable, value-free runtime snapshot. */
export interface IResolvedSecretManifest {
    schemaVersion: 2;
    id: string;
    digest: TSha256Digest;
    organizationId: string;
    serviceId: string;
    clusterId: string;
    imageRolloutId: string;
    imageRolloutGeneration: number;
    requestedImageDigest: TSha256Digest;
    invocationDigest: TSha256Digest;
    secretRolloutId: string;
    secretRolloutGeneration: number;
    entries: IResolvedSecretManifestEntry[];
    createdAt: number;
}
export interface IResolvedSecretManifestReference {
    manifestId: string;
    manifestDigest: TSha256Digest;
    clusterId: string;
    imageRolloutId: string;
    imageRolloutGeneration: number;
    requestedImageDigest: TSha256Digest;
    invocationDigest: TSha256Digest;
    secretRolloutId: string;
    secretRolloutGeneration: number;
}
export interface IAcceptedPreviousSecretManifest {
    manifest: IResolvedSecretManifestReference;
    /** Exclusive material-issuance deadline for tasks draining the previous rollout. */
    acceptedUntil: number;
}
export type TClusterSecretDeploymentStatus = 'pending' | 'applying' | 'applied' | 'drifted' | 'failed';
export interface IClusterSecretDeploymentState {
    clusterId: string;
    desiredManifest: IResolvedSecretManifestReference;
    appliedManifest?: IResolvedSecretManifestReference;
    previousAcceptedManifest?: IAcceptedPreviousSecretManifest;
    status: TClusterSecretDeploymentStatus;
    updatedAt: number;
}
/** Server-managed per-cluster authority switched with an expected revision CAS. */
export interface IServiceSecretDeploymentPlan {
    schemaVersion: 2;
    revision: number;
    clusterStates: IClusterSecretDeploymentState[];
    updatedAt: number;
}
export declare const resolvedSecretManifestReferencesEqual: (leftArg: IResolvedSecretManifestReference | undefined, rightArg: IResolvedSecretManifestReference | undefined) => boolean;
export declare const isResolvedSecretManifestReferenceAccepted: (stateArg: IClusterSecretDeploymentState, referenceArg: IResolvedSecretManifestReference, nowArg: number) => boolean;
export declare const validateSecretMutationId: (mutationIdArg: unknown) => string[];
export declare const validateSecretVersionRetentionReferences: (referencesArg: unknown) => string[];
export declare const validateSecretVersionMetadata: (versionArg: unknown) => string[];
export declare const validateSecretVersionPurgeIntent: (intentArg: unknown) => string[];
export declare const createSecretVersionPurgeIntentDigestInput: (intentArg: ISecretVersionPurgeIntentV1) => string;
export declare const computeSecretVersionPurgeIntentDigest: (intentArg: ISecretVersionPurgeIntentV1) => Promise<TSha256Digest>;
export declare const verifySecretVersionPurgeIntentDigest: (intentArg: ISecretVersionPurgeIntentV1, digestArg: unknown) => Promise<boolean>;
export declare const validateSecretVersionPurgeOperation: (operationArg: unknown) => Promise<string[]>;
export declare const validateSecretOwner: (ownerArg: unknown) => string[];
export declare const validateSecretManagementScope: (sourceArg: TSecretManagementSource, scopeArg: unknown) => string[];
export declare const validateSecretDelivery: (deliveryArg: unknown) => string[];
export declare const validateSecretMetadata: (secretArg: unknown) => string[];
export declare const validateSecretValueInput: (valueInputArg: unknown) => string[];
/** Checks the SmartCrypto context digest without opening or decrypting the envelope. */
export declare const verifySecretEnvelopeContext: (envelopeArg: unknown, contextArg: unknown) => Promise<boolean>;
/** Files accept arbitrary bytes; launcher values must be valid UTF-8 without NUL. */
export declare const validateSecretValueBytes: (valueBytesArg: unknown, deliveryArg: TSecretDelivery) => string[];
/**
 * One shared precedence rule for resolution and runtime verification.
 * A manifest is authoritative once published; before publication an attachment
 * override wins over the Secret default.
 */
export declare const resolveSecretDelivery: (deliveryArg: {
    secretDefault: TSecretDelivery;
    attachmentOverride?: TSecretDelivery;
    manifestDelivery?: TSecretDelivery;
}) => TSecretDelivery;
export declare const validateServiceSecretConfiguration: (configurationArg: unknown) => string[];
export declare const validateSecretSetAttachmentOwnership: (configurationArg: IServiceSecretConfiguration, serviceOrganizationIdArg: string, secretSetsArg: ISecretSetMetadata[]) => string[];
export declare const createResolvedSecretManifestDigestInput: (manifestArg: IResolvedSecretManifest) => string;
/** Shared canonical digest; the digest field itself is excluded from the input. */
export declare const computeResolvedSecretManifestDigest: (manifestArg: IResolvedSecretManifest) => Promise<TSha256Digest>;
export declare const verifyResolvedSecretManifestDigest: (manifestArg: IResolvedSecretManifest) => Promise<boolean>;
export declare const validateResolvedSecretManifest: (manifestArg: unknown) => string[];
/** Strict public validator for a cluster-scoped resolved manifest reference. */
export declare const validateResolvedSecretManifestReference: (referenceArg: unknown, expectedClusterIdArg: string) => string[];
export declare const validateServiceSecretDeploymentPlan: (planArg: unknown, expectedTargetClusterIdsArg?: string[]) => string[];
export declare const dockerSecretResourceNameDomain: "serve.zone/docker-secret-resource/v1";
export declare const workloadInitEnvironmentMapPath: "/run/serve.zone/workloadinit-map-v1.json";
export declare const workloadRuntimeAssetRoot: "/opt/serve.zone/runtime-assets";
export declare const workloadInitExecutablePath: "/opt/serve.zone/runtime-assets/workloadinit/v1/workloadinit";
export declare const workloadInitEnvironmentMapMode: 292;
export declare const workloadRuntimeAssetsReadOnly: true;
/** Stable resource name; no logical key or value material appears in Docker. */
export declare const createDockerSecretResourceName: (secretVersionIdArg: string) => Promise<`szsv-${string}`>;
export declare const createLauncherSecretSourcePath: (resourceArg: string) => `/run/serve.zone/secrets/${string}`;
export interface IWorkloadInitEnvironmentMapEntryV1 {
    variableName: string;
    resource: string;
    source: string;
}
export interface IWorkloadInitEnvironmentMapV1 {
    schemaVersion: 1;
    manifestId: string;
    manifestDigest: TSha256Digest;
    entries: IWorkloadInitEnvironmentMapEntryV1[];
}
/**
 * The nonsecret map is generated only from launcher deliveries. Direct file
 * deliveries mount their version resource at the declared target without the
 * launcher. Runtime assets are mounted read-only; no shell, symlink, or
 * aggregate material file participates in delivery.
 */
export declare const createWorkloadInitEnvironmentMap: (manifestArg: IResolvedSecretManifest) => Promise<IWorkloadInitEnvironmentMapV1>;
export declare const verifyWorkloadInitEnvironmentMap: (mapArg: unknown, manifestArg: IResolvedSecretManifest) => Promise<boolean>;
export interface IWorkloadInitWrappedInvocation {
    command: [typeof workloadInitExecutablePath];
    args: string[];
}
export declare const createWorkloadInitWrappedInvocation: (originalArgvArg: string[]) => IWorkloadInitWrappedInvocation;
/**
 * A Docker secret resource and its nonsecret map remain while any desired,
 * applied, or previous-accepted retained manifest references them. Deletion is
 * allowed only after no retained reference exists and Docker confirms the
 * corresponding rollout or service removal.
 */
export interface ISecretRuntimeResourceRetention {
    resource: string;
    retainedManifestIds: string[];
    dockerRemovalConfirmed: boolean;
}
export type TSecretRecipientLifecycleState = 'active' | 'retiring' | 'revoked';
interface ISecretRecipientMetadataBase {
    schemaVersion: 1;
    recipientKeyId: string;
    /** Canonical unpadded base64url raw 32-byte X25519 public key. */
    publicKey: string;
    generation: number;
    activatedAt: number;
}
export interface IActiveSecretRecipientMetadata extends ISecretRecipientMetadataBase {
    lifecycleState: 'active';
    acceptUntil?: never;
    revokedAt?: never;
}
export interface IRetiringSecretRecipientMetadata extends ISecretRecipientMetadataBase {
    lifecycleState: 'retiring';
    acceptUntil: number;
    revokedAt?: never;
}
export interface IRevokedSecretRecipientMetadata extends ISecretRecipientMetadataBase {
    lifecycleState: 'revoked';
    acceptUntil?: never;
    revokedAt: number;
}
export type TSecretRecipientMetadata = IActiveSecretRecipientMetadata | IRetiringSecretRecipientMetadata | IRevokedSecretRecipientMetadata;
export declare const secretRecipientLimits: Readonly<{
    maximumRecipients: 64;
}>;
export declare const validateSecretRecipientMetadata: (recipientArg: unknown) => string[];
export declare const validateSecretRecipientSet: (recipientsArg: unknown) => string[];
/** New envelopes target only active recipients. */
export declare const canIssueNewSecretEnvelope: (recipientArg: TSecretRecipientMetadata) => boolean;
export declare const validateSecretValueInputForRecipient: (valueInputArg: unknown, recipientArg: TSecretRecipientMetadata, expectedContextArg: Uint8Array) => Promise<string[]>;
export declare const createSecretCreateEnvelopeContext: (contextArg: {
    mutationId: string;
    target: TSecretMutationTarget;
    key: string;
    environment: TSecretEnvironment;
    delivery: TSecretDelivery;
    expectedTargetSecretsRevision: number;
}) => Uint8Array;
export declare const createSecretRotateEnvelopeContext: (contextArg: {
    mutationId: string;
    secretId: string;
    expectedSecretRevision: number;
    expectedActiveVersionId: string;
    expectedTargetSecretsRevision: number;
}) => Uint8Array;
export declare const createAppStoreInstallSecretEnvelopeContext: (contextArg: {
    mutationId: string;
    appId: string;
    appVersion: string;
    serviceId: string;
    key: string;
    delivery: TSecretDelivery;
    generation?: {
        encoding: TSecretGeneratedEncoding;
        bytes: number;
    };
}) => Uint8Array;
export declare const createResolvedSecretMaterialEnvelopeContext: (contextArg: {
    recipientKeyId: string;
    organizationId: string;
    clusterId: string;
    serviceId: string;
    imageRolloutId: string;
    imageRolloutGeneration: number;
    requestedImageDigest: TSha256Digest;
    secretRolloutId: string;
    secretRolloutGeneration: number;
    manifestId: string;
    manifestDigest: TSha256Digest;
    secretId: string;
    secretVersionId: string;
}) => Uint8Array;
export declare const createSecretRecipientEnrollmentChallengeContext: (contextArg: {
    enrollmentId: string;
    clusterId: string;
    recipientKeyId: string;
    publicKey: string;
    generation: number;
    expiresAt: number;
}) => Uint8Array;
export {};