/**
 * k8s-secret-render.ts — render `REPLACE_ME_FROM_*` placeholders in the
 * shipped k8s Secret templates with real values, and persist the rendered
 * set so reapply is idempotent.
 *
 * B5 of olam-issue-npm-only-k3s (npm-only operator bootstrap completion).
 *
 * The templates at `packages/host-cp/k8s/templates/*-secret-template.yaml`
 * carry placeholders like `REPLACE_ME_FROM_HOME_DOTOLAM_AUTH_SECRET`. The
 * source-of-truth value for each placeholder is documented in the template
 * comment block; it's either a host-side file in `~/.olam/` (the compose
 * bootstrap path) or a subprocess output (e.g. `gh auth token`).
 *
 * Source resolution per placeholder:
 *
 *   placeholder                                              → source
 *   REPLACE_ME_FROM_HOME_DOTOLAM_AUTH_SECRET                  → file ~/.olam/auth-secret           (generate if missing)
 *   REPLACE_ME_FROM_GH_AUTH_TOKEN                             → subprocess `gh auth token`         (warn + skip if absent)
 *   REPLACE_ME_FROM_HOME_DOTOLAM_AUTH_DB_SECRET               → file ~/.olam/auth-db-secret        (generate if missing)
 *   REPLACE_ME_FROM_HOME_DOTOLAM_MCP_AUTH_JWT_SECRET          → file ~/.olam/mcp-auth-jwt-secret   (generate if missing)
 *   REPLACE_ME_FROM_HOME_DOTOLAM_KG_BEARER_TOKEN              → file ~/.olam/kg-bearer-token       (generate if missing)
 *   REPLACE_ME_FROM_HOME_DOTOLAM_MEMORY_BEARER_SECRET         → file ~/.olam/memory-bearer-secret  (generate if missing)
 *
 * State persistence: `~/.olam/k8s-secrets-state.json` records the rendered
 * Secret set so re-runs (idempotent reapply) reuse the same values. Without
 * the state file every `olam upgrade` would rotate tokens silently, breaking
 * worlds that have cached the previous value. Operator opts in to rotation
 * via `--rotate-secrets`.
 *
 * D20 stdin-safe design: rendered YAML is built in-process and applied via
 * stdin to `kubectl apply -f -`. Placeholder values are NEVER inlined into
 * subprocess argv (audit:auth-callers + general security hygiene).
 */
export declare const K8S_SECRETS_STATE_PATH: string;
/**
 * One template's placeholder set + the per-host-file source it reads from.
 * Hardcoded mapping — every secret template's `# Source:` comment names the
 * file; the audit:cli-bundle-k8s gate ensures the templates stay in sync.
 */
export interface SecretTemplateBinding {
    readonly secretName: string;
    readonly templateRelPath: string;
    readonly placeholders: ReadonlyArray<{
        readonly placeholder: string;
        readonly key: string;
        readonly source: {
            readonly kind: 'file';
            readonly hostFile: string;
        } | {
            readonly kind: 'gh-token';
        } | {
            readonly kind: 'random-hex';
        };
    }>;
}
/** Canonical mapping for the 5 secret templates that ship with the CLI. */
export declare const SECRET_TEMPLATE_BINDINGS: ReadonlyArray<SecretTemplateBinding>;
/** Per-secret state record — keys map to RENDERED values reused on re-apply. */
export interface RenderedSecret {
    readonly keys: Record<string, string>;
    readonly skipped?: ReadonlyArray<string>;
}
/** State file shape. version=1 lets us migrate the schema without breaking older state. */
export interface K8sSecretsState {
    readonly version: 1;
    readonly context: string;
    readonly namespace: string;
    readonly generatedAt: string;
    readonly secrets: Record<string, RenderedSecret>;
}
/** Injectable deps so tests don't touch the real filesystem / shell. */
export interface RenderDeps {
    readonly olamHome?: string;
    readonly statePath?: string;
    readonly readFile?: (path: string, enc: 'utf8') => string;
    readonly writeFile?: (path: string, data: string, mode: number) => void;
    readonly fileExists?: (path: string) => boolean;
    readonly genRandomHex?: () => string;
    readonly runGhTokenCmd?: () => {
        ok: boolean;
        token: string;
    };
    readonly readState?: () => K8sSecretsState | null;
    readonly writeState?: (state: K8sSecretsState) => void;
    readonly stderr?: NodeJS.WritableStream;
}
/**
 * Read the state file. Returns null when missing OR when the version doesn't match (forward-compat).
 */
export declare function readSecretsState(statePath?: string): K8sSecretsState | null;
/** Atomically write the state file (0600). */
export declare function writeSecretsState(state: K8sSecretsState, statePath?: string): void;
/**
 * Result of rendering one Secret. Either:
 *   - resolved: every placeholder got a value (rendered YAML is ready to apply).
 *   - skipped:  at least one source was unavailable AND not generatable (e.g.
 *               gh auth token absent); the operator must apply this secret
 *               manually OR install gh + retry.
 */
export interface RenderResult {
    readonly secretName: string;
    readonly status: 'resolved' | 'skipped';
    readonly renderedYaml?: string;
    readonly keys: Record<string, string>;
    readonly missingSources: ReadonlyArray<string>;
}
/**
 * Substitute the placeholder strings in the template YAML with real values.
 * Builds a fresh Secret YAML string (does NOT touch the template on disk).
 *
 * The templates hold ONE placeholder per stringData key; literal string
 * substitution suffices. We avoid YAML parsing to keep the template comment
 * block (which carries operator-facing documentation) intact in the rendered
 * output.
 */
export declare function substitutePlaceholders(templateYaml: string, values: Record<string, string>): string;
/**
 * Render ONE secret template. Reads the template YAML from `templatesRoot`
 * (resolved by the caller to either source or install-mode location),
 * resolves each placeholder, persists generated values to host files,
 * substitutes, and returns the rendered YAML.
 *
 * `reuse` carries the prior state's per-key values when an unrotated
 * re-apply is requested; null means "this is the first apply or operator
 * asked for rotation."
 */
export declare function renderOneSecret(binding: SecretTemplateBinding, templatesRoot: string, reuse: RenderedSecret | null, deps?: RenderDeps, rotate?: boolean): RenderResult;
/**
 * Render the full set of shipped Secret templates. `rotate=true` discards
 * the on-disk state and regenerates every value; `rotate=false` reuses
 * state for unchanged secrets so worlds caching old tokens don't break.
 */
export declare function renderAllSecrets(templatesRoot: string, opts: {
    rotate: boolean;
    context: string;
    namespace: string;
}, deps?: RenderDeps): {
    results: ReadonlyArray<RenderResult>;
    nextState: K8sSecretsState;
};
//# sourceMappingURL=k8s-secret-render.d.ts.map