/**
 * HashiCorp Vault KMS Provider
 *
 * Implementation of KMSProvider interface for HashiCorp Vault's Transit
 * secrets engine. Supports:
 * - Transit secrets engine encryption/decryption
 * - Key versioning and rotation
 * - Token renewal handling
 * - TLS configuration
 *
 * @packageDocumentation
 * @module security/kms/vault
 */
import { VorionError } from '../../common/errors.js';
import type { KMSProvider, KeyMetadata, DataKey, KMSEncryptOptions, KMSDecryptOptions, GenerateDataKeyOptions, EncryptResult, DecryptResult, KeyRotationResult, KeyRotationSchedule, ListKeysOptions, VaultKMSConfig, KMSAuditCallback } from './types.js';
/**
 * Vault KMS specific error
 */
export declare class VaultKMSError extends VorionError {
    code: string;
    statusCode: number;
    constructor(message: string, code?: string, details?: Record<string, unknown>);
}
/**
 * HashiCorp Vault KMS Provider implementation
 *
 * Uses Vault's Transit secrets engine for encryption operations.
 *
 * @example
 * ```typescript
 * const provider = new HashiCorpVaultProvider({
 *   provider: 'vault',
 *   address: 'https://vault.example.com:8200',
 *   token: process.env.VAULT_TOKEN,
 *   transitMount: 'transit',
 *   keyName: 'my-encryption-key',
 * });
 *
 * await provider.initialize();
 *
 * // Generate data key for envelope encryption
 * const dataKey = await provider.generateDataKey();
 * ```
 */
export declare class HashiCorpVaultProvider implements KMSProvider {
    readonly name = "vault";
    private readonly config;
    private token;
    private tokenExpiresAt;
    private renewalInterval;
    private dataKeyCache;
    private readonly auditCallbacks;
    private initialized;
    private httpsAgent;
    constructor(config: VaultKMSConfig);
    /**
     * Initialize the Vault provider
     */
    initialize(): Promise<void>;
    /**
     * Shutdown the provider
     */
    shutdown(): Promise<void>;
    /**
     * Register an audit callback
     */
    onAudit(callback: KMSAuditCallback): void;
    /**
     * Emit audit event
     */
    private emitAudit;
    /**
     * Check provider health
     */
    healthCheck(): Promise<boolean>;
    /**
     * Ensure provider is initialized
     */
    private ensureInitialized;
    /**
     * Load token from config, file, or environment
     */
    private loadToken;
    /**
     * Configure TLS options
     */
    private configureTLS;
    /**
     * Start token renewal interval
     */
    private startTokenRenewal;
    /**
     * Renew the Vault token
     */
    private renewToken;
    /**
     * Make a request to Vault
     */
    private vaultRequest;
    /**
     * Get the transit engine path
     */
    private transitPath;
    /**
     * Get key metadata
     */
    getKey(keyId: string): Promise<KeyMetadata | null>;
    /**
     * List all keys
     */
    listKeys(_options?: ListKeysOptions): Promise<KeyMetadata[]>;
    /**
     * Encrypt data
     */
    encrypt(plaintext: Buffer, options?: KMSEncryptOptions): Promise<EncryptResult>;
    /**
     * Decrypt data
     */
    decrypt(ciphertext: Buffer, options?: KMSDecryptOptions): Promise<DecryptResult>;
    /**
     * Generate a data key for envelope encryption
     */
    generateDataKey(options?: GenerateDataKeyOptions): Promise<DataKey>;
    /**
     * Decrypt a data key
     */
    decryptDataKey(encryptedDataKey: Buffer, options?: KMSDecryptOptions): Promise<Buffer>;
    /**
     * Rotate a key
     */
    rotateKey(keyId: string): Promise<KeyRotationResult>;
    /**
     * Get rotation schedule for a key
     */
    getRotationSchedule(keyId: string): Promise<KeyRotationSchedule>;
    /**
     * Enable automatic key rotation
     */
    enableAutoRotation(keyId: string, rotationPeriodDays?: number): Promise<void>;
    /**
     * Disable automatic key rotation
     */
    disableAutoRotation(keyId: string): Promise<void>;
    /**
     * Build a cache key
     */
    private buildCacheKey;
    /**
     * Map Vault key info to KeyMetadata
     */
    private mapVaultKeyInfo;
    /**
     * Wrap errors
     */
    private wrapError;
    /**
     * Get cache statistics
     */
    getCacheStats(): {
        size: number;
        ttlMs: number;
        maxUsages: number;
    } | null;
}
//# sourceMappingURL=vault.d.ts.map