import type { SecretStore } from '@kici-dev/engine';
import type { Logger } from '@kici-dev/shared';
/**
 * Configuration for the Vault secret store backend.
 */
export interface VaultConfig {
    /** Vault server URL (e.g., 'http://vault:8200'). */
    vaultUrl: string;
    /** Authentication method. */
    authMethod: 'approle' | 'token';
    /** AppRole role ID (required for 'approle' auth). */
    roleId?: string;
    /** AppRole secret ID (required for 'approle' auth). */
    secretId?: string;
    /** Static Vault token (required for 'token' auth). */
    token?: string;
    /** Vault Enterprise namespace. */
    namespace?: string;
    /** KV v2 mount path (default: 'secret'). */
    mountPath?: string;
    /** Base path within mount (e.g., 'kici/secrets'). */
    basePath: string;
}
/**
 * HashiCorp Vault backend implementing SecretStore.
 *
 * Supports AppRole and token authentication. KV v2 CRUD operations
 * map (orgId, scope) to Vault paths under the configured basePath.
 */
export declare class VaultSecretStore implements SecretStore {
    private readonly client;
    private readonly config;
    private readonly mountPath;
    private readonly logger;
    private authState;
    constructor(config: VaultConfig, logger: Logger);
    /**
     * Log a Vault API request with structured context.
     * Captures operation, path, status, and optionally error for diagnostics.
     */
    private logVaultRequest;
    /**
     * Authenticate with Vault and cache the token with TTL tracking.
     */
    private authenticate;
    private getToken;
    private withRetry;
    /**
     * Build the full Vault path for a scoped secret.
     */
    private secretPath;
    /**
     * Get all secrets for a scope as key-value pairs.
     */
    getSecrets(orgId: string, scope: string): Promise<Record<string, string>>;
    /**
     * Set (create or update) a secret in a scope.
     */
    setSecret(orgId: string, scope: string, key: string, value: string): Promise<void>;
    /**
     * Delete a secret key from a scope.
     */
    deleteSecret(orgId: string, scope: string, key: string): Promise<void>;
    /**
     * List all secret key names in a scope.
     */
    listKeys(orgId: string, scope: string): Promise<string[]>;
    /**
     * List all distinct scopes for an org.
     * Vault KV v2 LIST only returns immediate children — directories end with '/'.
     * We recurse into directories to discover leaf scopes (paths that hold actual secrets).
     */
    listScopes(orgId: string): Promise<string[]>;
    /**
     * Get all secrets for an org (for resolver).
     * Lists scopes then reads each to collect all encrypted/plain values.
     */
    getAllSecrets(orgId: string): Promise<Array<{
        scope: string;
        key: string;
        encryptedValue: string;
        keyVersion: number;
    }>>;
}
//# sourceMappingURL=vault-secret-store.d.ts.map