import type { KeyValueStore } from '@enbox/common';
import type { IdentityVault } from './types/identity-vault.js';
/**
 * Options for storing a secret.
 */
export type SecretStorePutOptions = {
    /**
     * ISO-8601 timestamp after which the secret is considered expired.
     *
     * Expired secrets are silently deleted on the next {@link SecretStore.get}
     * call and `undefined` is returned.
     */
    expiresAt?: string;
};
/**
 * Platform-agnostic interface for storing classified secrets encrypted at rest
 * by the agent vault.
 *
 * Implementations must ensure that plaintext secret material is never persisted
 * to browser-accessible storage such as `localStorage` or `sessionStorage`.
 */
export interface SecretStore {
    /**
     * Store a secret, encrypted at rest with the vault key.
     *
     * @param key - Unique identifier for the secret.
     * @param value - The secret bytes to store.
     * @param options - Optional metadata (e.g. TTL).
     * @throws If the vault is locked.
     */
    put(key: string, value: Uint8Array, options?: SecretStorePutOptions): Promise<void>;
    /**
     * Retrieve and decrypt a secret.
     *
     * Returns `undefined` if the key does not exist or the secret has expired.
     *
     * @param key - The identifier used when the secret was stored.
     * @throws If the vault is locked.
     */
    get(key: string): Promise<Uint8Array | undefined>;
    /**
     * Delete a secret.
     *
     * @param key - The identifier used when the secret was stored.
     * @returns `true` if the key existed and was removed, `false` otherwise.
     */
    delete(key: string): Promise<boolean>;
}
/**
 * Vault-backed implementation of {@link SecretStore}.
 *
 * Secrets are encrypted with the vault's content encryption key (AES-256-GCM
 * via `dir` algorithm) before being persisted to the backing
 * {@link KeyValueStore}. The vault must be unlocked for {@link put} and
 * {@link get} operations; {@link delete} does not require the vault to be
 * unlocked since it only removes the encrypted envelope.
 */
export declare class VaultBackedSecretStore implements SecretStore {
    private readonly _vault;
    private readonly _store;
    constructor({ vault, store }: {
        vault: IdentityVault;
        store: KeyValueStore<string, string>;
    });
    put(key: string, value: Uint8Array, options?: SecretStorePutOptions): Promise<void>;
    get(key: string): Promise<Uint8Array | undefined>;
    delete(key: string): Promise<boolean>;
}
/**
 * In-memory implementation of {@link SecretStore} for testing.
 *
 * Secrets are stored as plain `Uint8Array` values in a `Map` — no encryption,
 * no persistence. This is suitable only for unit tests.
 */
export declare class InMemorySecretStore implements SecretStore {
    private readonly _store;
    put(key: string, value: Uint8Array, options?: SecretStorePutOptions): Promise<void>;
    get(key: string): Promise<Uint8Array | undefined>;
    delete(key: string): Promise<boolean>;
}
//# sourceMappingURL=secret-store.d.ts.map