/**
 * Backend registry for multi-source secret management.
 *
 * Manages the secret_backends table: CRUD operations, config encryption,
 * and factory methods to create SecretStore instances from registered backends.
 */
import { type Kysely } from 'kysely';
import type { BackendDescriptor, BackendType, BackendHealthStatus, AddBackendParams, SecretStore } from '@kici-dev/engine';
import type { Logger } from '@kici-dev/shared';
import type { AuditLogger } from './audit-logger.js';
/**
 * Registry for secret backends.
 *
 * Encrypts backend config at rest using AES-256-GCM with the backend name
 * as AAD to prevent cross-backend config swaps.
 */
export declare class BackendRegistry {
    private readonly db;
    private readonly masterKey;
    private readonly logger?;
    constructor(db: Kysely<any>, masterKey: Buffer, logger?: Logger | undefined);
    /**
     * Register a new backend. Encrypts config and stores in DB.
     */
    addBackend(params: AddBackendParams): Promise<BackendDescriptor>;
    /**
     * Ensure the default `pg` backend row exists. The initial migration seeds
     * this row with `config_encrypted = ''` (sentinel, never decrypted), but the
     * row can be lost to operator error, a buggy purge, or manual cleanup.
     * Idempotent — safe to call on every startup. Self-heals DBs where the row
     * was deleted so the admin API and `listBackends()` always expose `pg`.
     */
    ensureDefaultPgBackend(): Promise<void>;
    /**
     * Remove a backend by name. Returns true if a row was deleted.
     */
    removeBackend(name: string): Promise<boolean>;
    /**
     * List all registered backends (metadata only, no credentials).
     */
    listBackends(): Promise<BackendDescriptor[]>;
    /**
     * Get a single backend by name, or null if not found.
     */
    getBackend(name: string): Promise<BackendDescriptor | null>;
    /**
     * Get backend config (decrypted). Internal use only.
     */
    getBackendConfig(name: string): Promise<Record<string, unknown> | null>;
    /**
     * Create SecretStore instances for all enabled backends.
     * Returns a map of backend name to SecretStore.
     */
    loadAllStores(auditLogger: AuditLogger): Promise<Map<string, SecretStore>>;
    /**
     * Create a SecretStore for a given backend type and config.
     */
    createStoreForBackend(backendType: BackendType, config: Record<string, unknown>, auditLogger: AuditLogger): SecretStore | null;
    /**
     * Update health status for a backend.
     */
    updateHealthStatus(name: string, status: BackendHealthStatus, error?: string): Promise<void>;
    /**
     * Update sync status for a backend.
     */
    updateSyncStatus(name: string, scopeCount: number, error?: string): Promise<void>;
}
//# sourceMappingURL=backend-registry.d.ts.map