/**
 * KeyManager -- Centralized encryption key management and rotation.
 *
 * Manages the lifecycle of encryption keys used across the governance
 * framework. Supports key rotation with re-encryption of existing data,
 * key versioning, and automated rotation scheduling.
 *
 * T-043: Key management infrastructure.
 * T-044: Key rotation support.
 *
 * @connexum/ai-governance
 */
export interface KeyManagerConfig {
    /** Directory for key metadata (NOT the keys themselves) */
    keyDir: string;
    /** Master key for encrypting key metadata */
    masterSecret: string;
    /** Key rotation interval in ms (default: 10 min DEV MODE -- production: 90 days) */
    rotationIntervalMs?: number;
    /** Maximum number of old key versions to retain (default: 5) */
    maxKeyVersions?: number;
}
export interface KeyVersion {
    version: number;
    keyId: string;
    createdAt: string;
    rotatedAt?: string;
    active: boolean;
    /** HMAC of the derived key (for verification, NOT the key itself) */
    keyFingerprint: string;
}
export interface KeyRotationResult {
    previousVersion: number;
    newVersion: number;
    newKeyId: string;
    rotatedAt: string;
    filesReEncrypted?: number;
}
export declare class KeyManager {
    private config;
    private keysFile;
    private auditFile;
    constructor(config: KeyManagerConfig);
    /**
     * Get the currently active key material derived from master + version.
     */
    getCurrentKey(): {
        key: Buffer;
        version: number;
        keyId: string;
    };
    /**
     * Get key material for a specific version (for decrypting old data).
     */
    getKeyByVersion(version: number): {
        key: Buffer;
        keyId: string;
    } | null;
    /**
     * Rotate to a new key version.
     */
    rotate(): KeyRotationResult;
    /**
     * Check if key rotation is due.
     *
     * Distinguishes two distinct unsafe states:
     *   - key-store-empty: no keys exist at all; runtime cannot sign or verify.
     *     Emits audit event `key-store-empty` at CRITICAL severity.
     *   - key-rotation-overdue: keys exist but the active key has exceeded its
     *     rotation interval. Emits audit event `key-rotation-overdue`.
     *
     * Returns true for BOTH states (rotation is needed in either case).
     */
    isRotationDue(): boolean;
    /**
     * Get all key versions (metadata only, no key material).
     */
    listVersions(): KeyVersion[];
    /**
     * Get the active key version number.
     */
    getActiveVersion(): number;
    /**
     * Verify a key fingerprint matches.
     */
    verifyFingerprint(version: number): boolean;
    /**
     * Get key management statistics.
     */
    getStats(): {
        activeVersion: number;
        totalVersions: number;
        rotationDue: boolean;
        lastRotation?: string;
        nextRotation?: string;
    };
    private initializeFirstKey;
    /**
     * Get or create the persistent random salt used for HKDF key derivation.
     * Generated once at first init and persisted to disk, preventing
     * retroactive key computation if the master secret is compromised alone.
     */
    private getPersistedSalt;
    private deriveKey;
    private computeFingerprint;
    private pruneOldVersions;
    private loadVersions;
    private saveVersions;
    private audit;
}
//# sourceMappingURL=key-manager.d.ts.map