/**
 * Secret store configuration.
 */
export interface SecretStoreConfig {
    /** 32-byte AES-256 encryption key. */
    masterKey: Buffer;
    /** Key version for rotation tracking. Default 1. */
    keyVersion: number;
    /** Path to key file, if used. */
    keyFilePath: string | undefined;
    /** Previous master key for dual-key rotation. */
    oldMasterKey?: Buffer;
}
/**
 * Load the master encryption key from environment or file.
 *
 * Priority:
 * 1. Environment variable (envKey, defaults to KICI_SECRET_KEY)
 * 2. Key file (keyFilePath)
 *
 * @param envKey - Environment variable name to read. Defaults to KICI_SECRET_KEY.
 * @param keyFilePath - Optional path to a file containing the key material.
 * @returns 32-byte Buffer suitable for AES-256-GCM.
 * @throws If neither env var nor key file provides a valid key.
 */
export declare function loadMasterKey(envKey?: string, keyFilePath?: string): Buffer;
/**
 * Load the old (previous) master encryption key for key rotation.
 *
 * Returns undefined when no old key is configured (normal operation).
 * Returns a 32-byte Buffer when KICI_SECRET_KEY_OLD or a key file is set.
 *
 * @param envKey - Environment variable name to read. Defaults to KICI_SECRET_KEY_OLD.
 * @param keyFilePath - Optional path to a file containing the old key material.
 * @returns 32-byte Buffer or undefined if no old key is configured.
 */
export declare function loadOldMasterKey(envKey?: string, keyFilePath?: string): Buffer | undefined;
/**
 * Load the full secret store configuration.
 *
 * @param opts - Optional overrides for env var name, key file path, and key version.
 * @returns Complete SecretStoreConfig ready for PgSecretStore.
 */
export declare function loadSecretStoreConfig(opts?: {
    envKey?: string;
    keyFilePath?: string;
    keyVersion?: number;
    oldEnvKey?: string;
    oldKeyFilePath?: string;
}): SecretStoreConfig;
//# sourceMappingURL=config.d.ts.map