/**
 * Key ring for cookie signing.
 *
 * Encapsulates secret keys and crypto operations. Keys are never exposed -
 * only sign/verify operations are available. This prevents accidental
 * logging or leakage of secrets.
 *
 * @example
 * ```ts
 * const keyring = create_keyring(process.env.SECRET_FUZ_COOKIE_KEYS);
 * if (!keyring) throw new Error('No keys configured');
 *
 * const signed = await keyring.sign('user:123:1700000000');
 * const result = await keyring.verify(signed);
 * // result = { value: 'user:123:1700000000', key_index: 0 }
 * ```
 *
 * @module
 */
/**
 * Opaque keyring that encapsulates secret keys.
 * Only exposes sign/verify operations, never the raw keys.
 */
export interface Keyring {
    /**
     * Sign a value with HMAC SHA-256.
     * @returns signed value in format: `value.signature`
     */
    sign: (value: string) => Promise<string>;
    /**
     * Verify a signed value and extract the original.
     * Tries all keys in order to support key rotation.
     * @returns object with value and key_index, or null if invalid
     */
    verify: (signed_value: string) => Promise<{
        value: string;
        key_index: number;
    } | null>;
}
/**
 * Create a keyring from environment variable.
 *
 * Keys are separated by `__` for rotation support. First key is used
 * for signing, all keys are tried for verification.
 *
 * CryptoKeys are cached on first use for performance.
 *
 * **Security: key rotation is an operational concern.** Old keys remain valid
 * for verification indefinitely — a leaked old key can forge session cookies
 * until it is removed from `SECRET_FUZ_COOKIE_KEYS`. After rotating to a new
 * signing key, remove the old key within a grace period (e.g. 24–48 hours,
 * long enough for active sessions to re-sign with the new key via cookie
 * refresh). Treat `SECRET_FUZ_COOKIE_KEYS` changes as security-critical deploys.
 *
 * @param env_value - the SECRET_FUZ_COOKIE_KEYS environment variable
 * @returns keyring or null if no keys configured
 */
export declare const create_keyring: (env_value: string | undefined) => Keyring | null;
/**
 * Validate key ring configuration.
 *
 * Returns an error when no keys are configured (undefined, empty string,
 * or all-separator input like `'____'`), and for each key shorter than
 * `MIN_KEY_LENGTH` characters.
 *
 * @param env_value - the SECRET_FUZ_COOKIE_KEYS environment variable
 * @returns array of validation errors (empty if valid)
 */
export declare const validate_keyring: (env_value: string | undefined) => Array<string>;
/**
 * Result of `create_validated_keyring`.
 * Discriminated union — callers handle the error case their own way.
 */
export type ValidatedKeyringResult = {
    ok: true;
    keyring: Keyring;
} | {
    ok: false;
    errors: Array<string>;
};
/**
 * Validate and create a keyring in one step.
 *
 * Returns a discriminated union so callers handle exit/logging their own way
 * (e.g. `Deno.exit(1)` vs `runtime.exit(1)`).
 *
 * @param env_value - the SECRET_FUZ_COOKIE_KEYS environment variable
 * @returns `{ok: true, keyring}` or `{ok: false, errors}`
 */
export declare const create_validated_keyring: (env_value: string | undefined) => ValidatedKeyringResult;
//# sourceMappingURL=keyring.d.ts.map