import { APIResource } from "../resource.js";
import * as Core from "../core.js";
export declare class Secrets extends APIResource {
    /**
     * Create Secret
     */
    create(body: SecretCreateParams, options?: Core.RequestOptions): Core.APIPromise<Secret>;
    /**
     * Get Secret
     */
    retrieve(id: string, options?: Core.RequestOptions): Core.APIPromise<Secret>;
    /**
     * Replace a secret's value. The name cannot be changed; to rename, create a new
     * secret and delete the old one.
     */
    update(id: string, body: SecretUpdateParams, options?: Core.RequestOptions): Core.APIPromise<Secret>;
    /**
     * List project secrets. Supports filtering by creation time.
     */
    list(query?: SecretListParams, options?: Core.RequestOptions): Core.APIPromise<SecretListResponse>;
    list(options?: Core.RequestOptions): Core.APIPromise<SecretListResponse>;
    /**
     * Delete Secret
     */
    delete(id: string, options?: Core.RequestOptions): Core.APIPromise<void>;
    /**
     * Get Secrets Keypair
     */
    getPublicKey(options?: Core.RequestOptions): Core.APIPromise<SecretsKeypair>;
}
export interface Secret {
    /**
     * Unique identifier of the secret.
     */
    id: string;
    /**
     * The name the secret value is stored under.
     */
    secretKey: string;
}
export interface SecretsKeypair {
    /**
     * Identifier of the keypair the public key was minted from. Pass this back when
     * creating a secret so the ciphertext records which keypair sealed it, which keeps
     * decryption correct across keypair rotation.
     */
    id: string;
    /**
     * The project's HPKE public encryption key, base64-encoded. Encrypt secret values
     * with this key before creating a secret.
     */
    publicKey: string;
}
/**
 * A page of secrets.
 */
export interface SecretListResponse {
    /**
     * The page of matching secrets.
     */
    data: Array<Secret>;
    /**
     * The maximum number of results returned in this page.
     */
    limit: number;
    /**
     * Cursor for the next page. Pass it back as `cursor` on the next request to
     * continue paging. null when there are no more results.
     */
    nextCursor: string | null;
}
export interface SecretCreateParams {
    /**
     * The `id` returned by GET /v1/secrets/keypair, identifying the keypair whose
     * public key encrypted the value. Recorded with the secret so decryption stays
     * correct across keypair rotation.
     */
    keypairId: string;
    /**
     * The secret value encrypted with HPKE. In order to seal the secret value before
     * sending, get the project's public key from GET /v1/secrets/keypair. Decode the
     * publicKey using base64 into the raw 32-byte public key. Then, use HPKE Base mode
     * (RFC 9180) with the following algorithm suite: DHKEM(X25519, HKDF-SHA256),
     * HKDF-SHA256, and AES-256-GCM. Set both info and additional authenticated data
     * (AAD) to an empty byte string. Then, create a new sender context using the
     * public key and these settings, and encrypt the secret value as one message. Put
     * the 32-byte encapsulated key before the ciphertext and keep the authentication
     * tag at the end of the ciphertext. Encode the combined bytes with standard
     * base64. Send the result as sealedSecretValue: base64(enc || ciphertext)
     */
    sealedSecretValue: string;
    /**
     * The name to store the secret value under.
     */
    secretKey: string;
}
export interface SecretUpdateParams {
    /**
     * The `id` returned by GET /v1/secrets/keypair, identifying the keypair whose
     * public key encrypted the value. Recorded with the secret so decryption stays
     * correct across keypair rotation.
     */
    keypairId: string;
    /**
     * The new secret value encrypted with HPKE. In order to seal the secret value
     * before sending, get the project's public key from GET /v1/secrets/keypair.
     * Decode the publicKey using base64 into the raw 32-byte public key. Then, use
     * HPKE Base mode (RFC 9180) with the following algorithm suite: DHKEM(X25519,
     * HKDF-SHA256), HKDF-SHA256, and AES-256-GCM. Set both info and additional
     * authenticated data (AAD) to an empty byte string. Then, create a new sender
     * context using the public key and these settings, and encrypt the secret value as
     * one message. Put the 32-byte encapsulated key before the ciphertext and keep the
     * authentication tag at the end of the ciphertext. Encode the combined bytes with
     * standard base64. Send the result as sealedSecretValue: base64(enc || ciphertext)
     */
    sealedSecretValue: string;
}
export interface SecretListParams {
    /**
     * Pagination cursor. Pass the nextCursor from the previous response to fetch the
     * next page. Omit to start from the first page.
     */
    cursor?: string;
    /**
     * Only return secrets created on or before this timestamp (inclusive). RFC 3339,
     * e.g. 2026-01-20T00:00:00Z.
     */
    endAt?: string;
    /**
     * Maximum number of results to return.
     */
    limit?: number;
    /**
     * Only return secrets created on or after this timestamp (inclusive). RFC 3339,
     * e.g. 2026-01-19T00:00:00Z.
     */
    startAt?: string;
}
export declare namespace Secrets {
    export { type Secret as Secret, type SecretsKeypair as SecretsKeypair, type SecretListResponse as SecretListResponse, type SecretCreateParams as SecretCreateParams, type SecretUpdateParams as SecretUpdateParams, type SecretListParams as SecretListParams, };
}
//# sourceMappingURL=secrets.d.ts.map