/**
 * PostgreSQL-backed secret store implementing SecretStore.
 *
 * Encrypts secret values at rest using AES-256-GCM with AAD binding
 * (orgId:scope:keyName) to prevent cross-scope secret swaps.
 *
 * Operates on the scoped_secrets table with (org_id, scope, key) composite key.
 */
import { type Kysely } from 'kysely';
import type { Database } from '../db/types.js';
import type { SecretStore } from '@kici-dev/engine';
import type { AuditLogger } from './audit-logger.js';
/**
 * PostgreSQL secret store with AES-256-GCM encryption.
 * Uses scoped_secrets table keyed by (org_id, scope, key).
 */
export declare class PgSecretStore implements SecretStore {
    private readonly db;
    private readonly masterKey;
    private keyVersion;
    private readonly auditLogger;
    private readonly oldMasterKey?;
    /**
     * When false, setSecret() rejects for non-internal scopes (customer secrets disabled).
     * Internal scopes (__source__/* and __webhook__/*) are always allowed.
     */
    customerSecretsEnabled: boolean;
    constructor(db: Kysely<Database>, masterKey: Buffer, keyVersion: number, auditLogger: AuditLogger, oldMasterKey?: Buffer | undefined);
    /**
     * Create a PgSecretStore with keyVersion initialized from the database.
     * Reads MAX(key_version) from scoped_secrets to avoid version conflicts
     * after orchestrator restarts.
     */
    static create(db: Kysely<Database>, masterKey: Buffer, auditLogger: AuditLogger, oldMasterKey?: Buffer): Promise<PgSecretStore>;
    /**
     * Decrypt with current key, falling back to old key if available.
     * Follows the same dual-key pattern as decryptPrivateKey() in ephemeral-keys.ts.
     */
    private decryptWithFallback;
    /**
     * Get all secrets for a scope as decrypted key-value pairs.
     */
    getSecrets(orgId: string, scope: string): Promise<Record<string, string>>;
    /**
     * Set (create or update) a secret in a scope.
     * Encrypts the value with AAD = "orgId:scope:key".
     */
    /** Check if a scope is internal/operational (always allowed regardless of toggle). */
    private isInternalScope;
    setSecret(orgId: string, scope: string, key: string, value: string): Promise<void>;
    /**
     * Delete a secret from a scope.
     */
    deleteSecret(orgId: string, scope: string, key: string): Promise<void>;
    /**
     * List all secret key names in a scope (no values returned).
     */
    listKeys(orgId: string, scope: string): Promise<string[]>;
    /**
     * List all distinct scopes for an org.
     *
     * When orgId is empty, returns all distinct org_ids (with trailing slash)
     * to support backend-sync scope discovery. This matches the Vault convention
     * where listScopes('') returns top-level directory entries.
     */
    listScopes(orgId: string): Promise<string[]>;
    /**
     * Get all secrets for an org (for resolver).
     * Returns scope, key, encrypted value, and key version without decrypting.
     */
    getAllSecrets(orgId: string): Promise<Array<{
        scope: string;
        key: string;
        encryptedValue: string;
        keyVersion: number;
    }>>;
    /**
     * Decrypt a single secret value given its encrypted data, key version, and AAD components.
     */
    decryptValue(orgId: string, scope: string, key: string, encryptedValue: string, keyVersion: number): string;
    /**
     * Create an empty scope using a sentinel row (__empty__ key).
     * If the scope already has keys, this is a no-op (idempotent).
     */
    createScope(orgId: string, scope: string): Promise<void>;
    /**
     * Rename a scope -- atomically update scoped_secrets and environment_bindings.
     */
    renameScope(orgId: string, oldScope: string, newScope: string): Promise<void>;
    /**
     * Delete a scope and all its secrets, plus any environment bindings referencing it.
     */
    deleteScope(orgId: string, scope: string): Promise<void>;
    /**
     * Rotate the encryption key version.
     * Re-encrypts all secrets with the same master key but a new key version.
     * Runs in a transaction for atomicity.
     *
     * @returns Number of re-encrypted secret values.
     */
    rotateKey(): Promise<{
        reEncrypted: number;
    }>;
}
//# sourceMappingURL=pg-secret-store.d.ts.map