/**
 * ISecretsProvider — pluggable secret storage/retrieval interface.
 *
 * Lives in workspaces/plugins (all pluggable interface contracts centralized here).
 * Built-in implementations live in workspaces/secrets.
 *
 * Signature locked per Phase 1 plan decision E5.
 */
/**
 * Metadata record returned by {@link ISecretsProvider.getMetadata}.
 *
 * Carries audit timestamps and optional ownership information without
 * exposing the secret value itself.
 *
 * @docLink packages/workspace-plugin/index#plugin-interfaces
 */
export interface SecretMetadata {
    ref: string;
    createdAt: Date;
    updatedAt: Date;
    lastAccessedAt?: Date;
    owner?: string;
    scopeSummary?: string;
}
/**
 * Feature flags advertised by a secrets provider via
 * {@link ISecretsProvider.getCapabilities}.
 *
 * Consumers use this to determine whether rotation, TTL, or batch operations
 * are available before calling the corresponding methods.
 *
 * @docLink packages/workspace-plugin/index#plugin-interfaces
 */
export interface ProviderCapabilities {
    supportsRotation: boolean;
    supportsExpiry: boolean;
    supportsBatch: boolean;
    scopeModel: "flat" | "hierarchical";
}
/**
 * Options accepted by {@link ISecretsProvider.setSecret}.
 *
 * @docLink packages/workspace-plugin/index#plugin-interfaces
 */
export interface SetSecretOptions {
    ttlSeconds?: number;
    metadata?: Record<string, string>;
}
/**
 * Filter parameters accepted by {@link ISecretsProvider.listSecrets}.
 *
 * All fields are optional — an empty filter returns all accessible secrets.
 *
 * @docLink packages/workspace-plugin/index#plugin-interfaces
 */
export interface ListFilter {
    prefix?: string;
    owner?: string;
    limit?: number;
}
/**
 * Base error class for all secrets-layer failures.
 *
 * Carries a machine-readable `code` string alongside the human-readable
 * message so callers can switch on error type without instanceof chains.
 *
 * @docLink packages/workspace-plugin/index#plugin-interfaces
 */
export declare class SecretsError extends Error {
    code: string;
    constructor(message: string, code: string);
}
/**
 * Thrown by {@link ISecretsProvider.getSecret} when the requested `ref` does
 * not exist in the provider's backing store.
 *
 * @docLink packages/workspace-plugin/index#plugin-interfaces
 */
export declare class SecretNotFoundError extends SecretsError {
    constructor(ref: string);
}
/**
 * Thrown when the caller does not have permission to access a secret.
 *
 * @docLink packages/workspace-plugin/index#plugin-interfaces
 */
export declare class SecretAccessDeniedError extends SecretsError {
    constructor(message?: string);
}
/**
 * Thrown by {@link ISecretsProvider.getSecret} when the secret exists but its
 * TTL has elapsed.
 *
 * @docLink packages/workspace-plugin/index#plugin-interfaces
 */
export declare class SecretExpiredError extends SecretsError {
    constructor(ref: string);
}
/**
 * Thrown when the backing secrets provider cannot be reached.
 *
 * Carries an optional `cause` string with provider-specific diagnostics.
 *
 * @docLink packages/workspace-plugin/index#plugin-interfaces
 */
export declare class ProviderUnavailableError extends SecretsError {
    constructor(providerId: string, cause?: string);
}
/**
 * Pluggable interface for secret storage and retrieval.
 *
 * Built-in implementations (Phase 1): `LocalSecretsProvider`, `EnvSecretsProvider`
 * (in `workspaces/secrets`).  Future implementations include Vault, AWS SM,
 * GCP SM, Azure Key Vault, Infisical, Doppler, and Bitwarden Secrets.
 *
 * Registration is explicit and programmatic: `pluginRegistry.register(impl)`.
 * Third-party providers are loaded via dynamic import driven by config.
 *
 * @docLink packages/workspace-plugin/index#plugin-interfaces
 */
export interface ISecretsProvider {
    /** Unique provider identifier used for registration and diagnostics. */
    readonly id: string;
    /** Retrieve a secret by ref, returning the raw bytes. */
    getSecret(ref: string): Promise<Uint8Array>;
    /** Store or update a secret. Optional TTL and metadata can be attached. */
    setSecret(ref: string, value: Uint8Array, opts?: SetSecretOptions): Promise<void>;
    /** Permanently remove a secret. */
    deleteSecret(ref: string): Promise<void>;
    /** List secret refs accessible to the caller, with optional filtering. */
    listSecrets(filter?: ListFilter): Promise<string[]>;
    /** Verify the provider is reachable and measure round-trip latency. */
    testConnection(): Promise<{
        ok: boolean;
        latencyMs?: number;
        error?: string;
    }>;
    /** Return audit metadata for a secret without revealing its value. */
    getMetadata(ref: string): Promise<SecretMetadata>;
    /** Advertise which optional capabilities this provider supports. */
    getCapabilities(): ProviderCapabilities;
}
//# sourceMappingURL=secrets-provider.d.ts.map