/**
 * Database-backed shared configuration store with versioning.
 *
 * Provides CRUD operations for orchestrator shared configuration stored
 * in the config_versions PostgreSQL table. Each save creates a new immutable
 * version with audit trail. Sensitive fields are encrypted at rest using
 * AES-256-GCM via the master key.
 *
 * Key operations:
 * - getLatest(): retrieve current config (decrypted)
 * - getByVersion(): retrieve a specific version
 * - save(): validate, encrypt sensitive fields, store new version
 * - rollback(): copy a previous version as a new version
 * - listHistory(): version audit trail (metadata only)
 * - getCurrentVersion(): current version number (for cluster heartbeat)
 * - exportRedacted(): config with sensitive fields masked
 */
import { type Kysely } from 'kysely';
import type { Database } from '../db/types.js';
import type { SharedConfig } from './types.js';
/**
 * Version metadata returned by listHistory().
 */
export interface ConfigVersionMeta {
    version: number;
    createdAt: Date;
    createdBy: string;
    description: string | null;
}
/**
 * Database-backed shared configuration store with versioning, encryption, and audit trail.
 */
export declare class SharedConfigStore {
    private db;
    private masterKey;
    /** Previous master key, accepted during the rotation grace window. */
    private oldMasterKey;
    /**
     * Active master-key generation. New inserts stamp this value into
     * `config_versions.key_version`; rotation bumps it after re-encrypting
     * every row in a single transaction.
     */
    private keyVersion;
    constructor(db: Kysely<Database>, masterKey: Buffer | null, 
    /** Previous master key, accepted during the rotation grace window. */
    oldMasterKey?: Buffer | null, keyVersion?: number);
    /**
     * Construct a `SharedConfigStore` with the active key generation hydrated
     * from the database.
     *
     * Mirrors `PgSecretStore.create`: reads `MAX(key_version)` from
     * `config_versions` so a freshly-restarted orchestrator keeps writing under
     * the same generation as the last row committed before shutdown. Empty
     * tables fall back to generation 1.
     */
    static create(db: Kysely<Database>, masterKey: Buffer | null, oldMasterKey?: Buffer | null): Promise<SharedConfigStore>;
    /**
     * Get the latest config version (decrypt if master key available).
     * Returns null if no config versions exist.
     */
    getLatest(): Promise<{
        config: SharedConfig;
        version: number;
    } | null>;
    /**
     * Get a specific config version by version number.
     * Returns null if the version doesn't exist.
     */
    getByVersion(version: number): Promise<{
        config: SharedConfig;
        version: number;
    } | null>;
    /**
     * Save a new config version.
     * Validates with sharedConfigSchema, encrypts sensitive fields,
     * and stores as a new immutable version.
     *
     * @param config - The config object to save
     * @param createdBy - Who created this version (e.g., "cli:seed", "api:set")
     * @param description - Human-readable change description
     * @returns The new version number
     */
    save(config: Record<string, unknown>, createdBy: string, description?: string): Promise<number>;
    /**
     * List version history (metadata only, no config bodies).
     * Returns versions in reverse chronological order.
     *
     * @param limit - Maximum number of versions to return (default 50)
     */
    listHistory(limit?: number): Promise<ConfigVersionMeta[]>;
    /**
     * Rollback to a specific version.
     * Reads the target version and creates a new version as a copy.
     *
     * @param targetVersion - Version number to rollback to
     * @param createdBy - Who initiated the rollback
     * @returns The new version number
     * @throws Error if target version doesn't exist
     */
    rollback(targetVersion: number, createdBy: string): Promise<number>;
    /**
     * Get the current (latest) version number.
     * Returns 0 if no versions exist.
     * Used by cluster heartbeats to broadcast config version.
     */
    getCurrentVersion(): Promise<number>;
    /**
     * Export the current config with sensitive fields redacted.
     * Returns null if no config versions exist.
     * Used for CLI export and diff operations.
     */
    exportRedacted(): Promise<Record<string, unknown> | null>;
    /**
     * Rotate the master-key generation for every row in `config_versions`.
     *
     * Mirrors `PgSecretStore.rotateKey`: opens a transaction, loads every row,
     * decrypts with the current key (falling back to `oldMasterKey` when set),
     * re-encrypts under the current master key at `max(key_version) + 1`, and
     * updates only `config` + `key_version`. Audit columns (`created_at`,
     * `created_by`, `description`, `version`, `encrypted_paths`) are
     * deliberately untouched so the history trail stays immutable and
     * `rollback()` / `getByVersion()` keep their semantics.
     *
     * Historical rows are re-encrypted too — otherwise rollback to an older
     * version would fail once `KICI_SECRET_KEY_OLD` is removed.
     *
     * Rows with no encrypted fields (`encrypted_paths = []`) still have their
     * `key_version` bumped so a fully-rotated table has a single generation,
     * but they don't contribute to the `reEncrypted` counter.
     *
     * @returns The number of rows whose ciphertext was re-sealed.
     */
    rotateKey(): Promise<{
        reEncrypted: number;
        skipped: number;
    }>;
    /**
     * Convert a DB row to a SharedConfig with decryption.
     */
    private rowToConfig;
}
//# sourceMappingURL=shared-store.d.ts.map