import type * as plugins from '../plugins.js';
import type { IResolvedSecretManifestEntry, IActiveSecretRecipientMetadata, ISecretMetadata, ISecretSetAttachment, ISecretSetConsumerRolloutStatus, ISecretSetMetadata, ISecretVersionMetadata, ISecretVersionPurgeIntentV1, ISecretVersionRetentionReference, TSecretVersionPurgeOperationV1, TSecretMutationTarget, TSecretValueInput, TSecretDelivery, TSecretEnvironment } from '../data/secret.js';
import type { IIdentityCredential } from '../data/user.js';
export interface IReq_GetSecretIngressRecipient extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_GetSecretIngressRecipient> {
    method: 'getSecretIngressRecipient';
    request: {
        identity: IIdentityCredential;
    };
    response: {
        recipient: IActiveSecretRecipientMetadata;
    };
}
export interface IReq_ListSecrets extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_ListSecrets> {
    method: 'listSecrets';
    request: {
        identity: IIdentityCredential;
        mutationId: string;
        target: TSecretMutationTarget;
        environment?: TSecretEnvironment;
    };
    response: {
        secrets: ISecretMetadata[];
        /** Observable CAS fence for the selected service or SecretSet. */
        targetSecretsRevision: number;
    };
}
export interface IReq_GetSecretMetadata extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_GetSecretMetadata> {
    method: 'getSecretMetadata';
    request: {
        identity: IIdentityCredential;
        mutationId: string;
        secretId: string;
    };
    response: {
        secret: ISecretMetadata;
        versions: ISecretVersionMetadata[];
    };
}
export interface IReq_CreateSecret extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CreateSecret> {
    method: 'createSecret';
    request: {
        identity: IIdentityCredential;
        mutationId: string;
        target: TSecretMutationTarget;
        key: string;
        environment: TSecretEnvironment;
        name: string;
        description?: string;
        tags?: Array<{
            key: string;
            value: string;
        }>;
        delivery: TSecretDelivery;
        valueInput: TSecretValueInput;
        expectedTargetSecretsRevision: number;
    };
    response: {
        secret: ISecretMetadata;
        version: ISecretVersionMetadata;
        /** Post-create CAS revision for the selected target. */
        targetSecretsRevision: number;
    };
}
export interface IReq_RotateSecret extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_RotateSecret> {
    method: 'rotateSecret';
    request: {
        identity: IIdentityCredential;
        mutationId: string;
        secretId: string;
        valueInput: TSecretValueInput;
        expectedSecretRevision: number;
        expectedActiveVersionId: string;
        /** Aggregate owner fence incremented by every secret mutation. */
        expectedTargetSecretsRevision: number;
    };
    response: {
        secret: ISecretMetadata;
        version: ISecretVersionMetadata;
        targetSecretsRevision: number;
    };
}
export interface IReq_ChangeSecretLifecycle extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_ChangeSecretLifecycle> {
    method: 'changeSecretLifecycle';
    request: {
        identity: IIdentityCredential;
        secretId: string;
        action: 'retire' | 'revoke' | 'delete';
        expectedSecretRevision: number;
        expectedTargetSecretsRevision: number;
    };
    response: {
        secret: ISecretMetadata;
        targetSecretsRevision: number;
    };
}
export interface IReq_GetSecretVersionPurgePreflight extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_GetSecretVersionPurgePreflight> {
    method: 'getSecretVersionPurgePreflight';
    request: {
        identity: IIdentityCredential;
        secretId: string;
        secretVersionId: string;
        cursor?: string;
        limit?: number;
    };
    response: {
        schemaVersion: 1;
        secret: ISecretMetadata;
        version: ISecretVersionMetadata;
        targetSecretsRevision: number;
        eligible: boolean;
        blockers: TSecretVersionPurgeBlocker[];
        blockingReferenceCount: number;
        references: ISecretVersionRetentionReference[];
        nextCursor?: string;
        referencesTruncated: boolean;
        operation?: TSecretVersionPurgeOperationV1;
    };
}
export type TSecretVersionPurgeBlocker = 'version-active' | 'retention-reference' | 'purge-pending' | 'already-purged';
export interface IReq_PurgeSecretVersion extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_PurgeSecretVersion> {
    method: 'purgeSecretVersion';
    request: ISecretVersionPurgeIntentV1 & {
        identity: IIdentityCredential;
    };
    response: {
        secret: ISecretMetadata;
        version: ISecretVersionMetadata;
        operation: TSecretVersionPurgeOperationV1;
        targetSecretsRevision: number;
    };
}
export interface IReq_ListSecretSets extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_ListSecretSets> {
    method: 'listSecretSets';
    request: {
        identity: IIdentityCredential;
        organizationId: string;
    };
    response: {
        secretSets: ISecretSetMetadata[];
    };
}
export interface IReq_CreateSecretSet extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CreateSecretSet> {
    method: 'createSecretSet';
    request: {
        identity: IIdentityCredential;
        organizationId: string;
        name: string;
        description?: string;
    };
    response: {
        secretSet: ISecretSetMetadata;
    };
}
export interface IReq_UpdateSecretSet extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_UpdateSecretSet> {
    method: 'updateSecretSet';
    request: {
        identity: IIdentityCredential;
        secretSetId: string;
        name: string;
        description?: string;
        expectedRevision: number;
    };
    response: {
        secretSet: ISecretSetMetadata;
    };
}
export interface IReq_ChangeSecretSetLifecycle extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_ChangeSecretSetLifecycle> {
    method: 'changeSecretSetLifecycle';
    request: {
        identity: IIdentityCredential;
        secretSetId: string;
        action: 'retire' | 'delete';
        expectedRevision: number;
        /** Prevents lifecycle changes racing any secret mutation in this set. */
        expectedSecretsRevision: number;
    };
    response: {
        secretSet: ISecretSetMetadata;
    };
}
export interface IReq_GetSecretSetConsumerRollout extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_GetSecretSetConsumerRollout> {
    method: 'getSecretSetConsumerRollout';
    request: {
        identity: IIdentityCredential;
        secretSetId: string;
        rolloutId: string;
        cursor?: string;
        limit?: number;
    };
    response: {
        consumers: ISecretSetConsumerRolloutStatus[];
        nextCursor?: string;
    };
}
export interface IReq_SetServiceSecretSetAttachments extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_SetServiceSecretSetAttachments> {
    method: 'setServiceSecretSetAttachments';
    request: {
        identity: IIdentityCredential;
        serviceId: string;
        attachments: ISecretSetAttachment[];
        expectedSecretConfigurationRevision: number;
    };
    response: {
        attachments: ISecretSetAttachment[];
        /** Post-update attachment CAS revision. */
        secretConfigurationRevision: number;
    };
}
export interface ISecretResolutionPreviewCollision {
    environment: TSecretEnvironment;
    key: string;
    sourceSecretIds: string[];
    reason: 'duplicate-secret-set-key' | 'duplicate-service-key' | 'invalid-alias';
}
export interface IReq_PreviewServiceSecretResolution extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_PreviewServiceSecretResolution> {
    method: 'previewServiceSecretResolution';
    request: {
        identity: IIdentityCredential;
        serviceId: string;
        attachments?: ISecretSetAttachment[];
    };
    response: {
        entries: IResolvedSecretManifestEntry[];
        collisions: ISecretResolutionPreviewCollision[];
    };
}
export declare const validateCreateSecretRequest: (requestArg: unknown, activeIngressRecipientArg: IActiveSecretRecipientMetadata) => Promise<string[]>;
export declare const validateRotateSecretRequest: (requestArg: unknown, activeIngressRecipientArg: IActiveSecretRecipientMetadata) => Promise<string[]>;
export declare const validatePurgeSecretVersionRequest: (requestArg: unknown) => string[];
export declare const validateGetSecretVersionPurgePreflightRequest: (requestArg: unknown) => string[];
export declare const validateSecretVersionPurgePreflightResponse: (responseArg: unknown) => Promise<string[]>;