/**
 * Secret Generator for Vorion
 *
 * Provides secure secret generation and management for deployment.
 * Generates cryptographically secure secrets for JWT, encryption, CSRF, etc.
 *
 * @packageDocumentation
 */
/**
 * Generated secrets structure
 */
export interface GeneratedSecrets {
    /** JWT signing secret (64 bytes, base64 encoded) */
    jwtSecret: string;
    /** AES-256-GCM encryption key (32 bytes, base64 encoded) */
    encryptionKey: string;
    /** PBKDF2 salt for key derivation (16 bytes, base64 encoded) */
    encryptionSalt: string;
    /** HMAC secret for deduplication hashing (32 bytes, base64 encoded) */
    dedupeSecret: string;
    /** HMAC secret for CSRF token signing (32 bytes, base64 encoded) */
    csrfSecret: string;
    /** Timestamp when secrets were generated */
    generatedAt: string;
    /** Version of the secret generation format */
    version: number;
}
/**
 * Calculate Shannon entropy of a string in bits.
 *
 * Used to validate secret quality and detect weak secrets.
 * A good cryptographic secret should have high entropy (close to the
 * theoretical maximum based on character set and length).
 *
 * @param str - The string to analyze
 * @returns Entropy in bits
 */
export declare function calculateEntropy(str: string): number;
/**
 * Generate a cryptographically secure random secret.
 *
 * Uses Node.js crypto.randomBytes which is backed by the OS CSPRNG.
 *
 * @param bytes - Number of random bytes to generate (default: 64)
 * @returns Base64-encoded secret string
 */
export declare function generateSecret(bytes?: number): string;
/**
 * Generate a cryptographically secure secret with entropy validation.
 *
 * Throws an error if the generated secret doesn't meet minimum entropy
 * requirements (which should never happen with a working CSPRNG).
 *
 * @param bytes - Number of random bytes to generate
 * @param minEntropy - Minimum required entropy in bits (default: 128)
 * @returns Base64-encoded secret string
 * @throws Error if generated secret has insufficient entropy
 */
export declare function generateSecretWithValidation(bytes?: number, minEntropy?: number): string;
/**
 * Generate all required secrets for Vorion deployment.
 *
 * Generates:
 * - jwtSecret: 64 bytes for JWT signing (512 bits)
 * - encryptionKey: 32 bytes for AES-256-GCM (256 bits)
 * - encryptionSalt: 16 bytes for PBKDF2 (128 bits)
 * - dedupeSecret: 32 bytes for HMAC (256 bits)
 * - csrfSecret: 32 bytes for CSRF tokens (256 bits)
 *
 * @returns Generated secrets object
 */
export declare function generateSecrets(): GeneratedSecrets;
/**
 * Generate a deterministic key fingerprint for secret identification.
 *
 * Creates a short hash that can be used to identify which secrets are
 * in use without exposing the actual secret values.
 *
 * @param secret - The secret to fingerprint
 * @returns First 8 characters of SHA-256 hash
 */
export declare function getSecretFingerprint(secret: string): string;
/**
 * Load existing secrets from file or generate new ones.
 *
 * If secrets file exists and is valid, loads and returns existing secrets.
 * Otherwise, generates new secrets and saves them with restricted permissions.
 *
 * The secrets file is created with mode 0o600 (owner read/write only).
 *
 * @param dataDir - Directory to store/load secrets from
 * @returns Loaded or generated secrets
 */
export declare function loadOrGenerateSecrets(dataDir: string): Promise<GeneratedSecrets>;
/**
 * Apply generated secrets to environment variables.
 *
 * Sets the appropriate VORION_* environment variables from the secrets.
 * Does not override variables that are already set.
 *
 * @param secrets - The secrets to apply
 * @param override - Whether to override existing env vars (default: false)
 */
export declare function applySecretsToEnv(secrets: GeneratedSecrets, override?: boolean): void;
/**
 * Generate environment file content from secrets.
 *
 * Creates a .env file format string that can be written to disk
 * or used with docker-compose.
 *
 * @param secrets - The secrets to format
 * @returns Environment file content
 */
export declare function generateEnvFileContent(secrets: GeneratedSecrets): string;
/**
 * Rotate secrets by generating new ones.
 *
 * Generates a completely new set of secrets. The caller is responsible
 * for handling the transition (e.g., supporting both old and new secrets
 * during a migration period).
 *
 * @returns New generated secrets
 */
export declare function rotateSecrets(): GeneratedSecrets;
/**
 * Validate that a secret meets minimum security requirements.
 *
 * Checks:
 * - Minimum length
 * - Minimum entropy
 * - Not a known weak pattern
 *
 * @param secret - The secret to validate
 * @param name - Name of the secret (for error messages)
 * @param minLength - Minimum required length (default: 32)
 * @returns Validation result
 */
export declare function validateSecret(secret: string, name: string, minLength?: number): {
    valid: boolean;
    error?: string;
};
//# sourceMappingURL=secret-generator.d.ts.map