import { type Kysely } from "kysely";
import type { SecretsDB } from "../db/schema.js";
import type { OpenBaoTransitClient } from "../openbao-transit.js";
/**
 * Shared service for reading + writing tenant env vars and secrets. Used by:
 *   - The GraphQL resolvers (`vetra-cloud-secrets` subgraph) — the public
 *     surface that the vetra.to Configuration UI talks to.
 *   - The `vetra-cloud-environment` gitops processor — when emitting tenant
 *     values.yaml, it routes env entries through here so secrets land in
 *     the encrypted `tenant_secrets` table (and never in plaintext in the
 *     synced values.yaml).
 *
 * All writes pg_notify('vetra_secrets_changed', tenantId) inside the
 * same transaction so the standalone `vetra-secrets-controller` pod
 * picks up the change and materializes the tenant ConfigMap/Secret.
 */
export declare const KEY_PATTERN: RegExp;
export declare const NOTIFY_CHANNEL = "vetra_secrets_changed";
export declare class InvalidSecretsKeyError extends Error {
    constructor(key: string);
}
export interface SecretsService {
    /** Plaintext env vars for one tenant, sorted by key. */
    listEnvVars(tenantId: string): Promise<Array<{
        key: string;
        value: string;
    }>>;
    /** Secret KEY names for one tenant (values never returned), sorted. */
    listSecretKeys(tenantId: string): Promise<Array<{
        key: string;
    }>>;
    /** Upsert a plaintext env var. Notifies the secrets-controller. */
    setEnvVar(tenantId: string, key: string, value: string): Promise<{
        key: string;
        value: string;
    }>;
    /** Remove a plaintext env var. Returns true if a row was deleted. */
    deleteEnvVar(tenantId: string, key: string): Promise<boolean>;
    /** Upsert a secret. The value is encrypted via OpenBao transit before storage. */
    setSecret(tenantId: string, key: string, value: string): Promise<{
        key: string;
    }>;
    /**
     * Upsert several secrets for one tenant atomically: all rows + a SINGLE
     * pg_notify in one transaction. The single notify is the load-bearing
     * property — it makes the secrets-controller reconcile the tenant ONCE, so
     * the agent pod gets ONE Reloader bounce instead of one per key. Used by the
     * warm-pool claim to deliver the Anthropic key(s) + ADMINS in a single pod
     * rollout. Keys are validated and values encrypted before the transaction
     * opens, so an invalid key fails the whole batch with nothing written.
     */
    setSecrets(tenantId: string, entries: Array<{
        key: string;
        value: string;
    }>): Promise<void>;
    /** Remove a secret. Returns true if a row was deleted. */
    deleteSecret(tenantId: string, key: string): Promise<boolean>;
}
export interface CreateSecretsServiceArgs {
    db: Kysely<SecretsDB>;
    transit: OpenBaoTransitClient;
}
export declare function createSecretsService({ db, transit, }: CreateSecretsServiceArgs): SecretsService;
//# sourceMappingURL=secrets-service.d.ts.map