/**
 * Local KMS Provider (Development Only)
 *
 * Implementation of KMSProvider interface for local development and testing.
 * Uses local file or environment variables for key storage.
 *
 * WARNING: This provider is NOT suitable for production use!
 * It provides minimal security and is intended only for development
 * and testing environments.
 *
 * @packageDocumentation
 * @module security/kms/local
 */
import { VorionError } from '../../common/errors.js';
import type { KMSProvider, KeyMetadata, DataKey, KMSEncryptOptions, KMSDecryptOptions, GenerateDataKeyOptions, EncryptResult, DecryptResult, KeyRotationResult, KeyRotationSchedule, ListKeysOptions, LocalKMSConfig, KMSAuditCallback } from './types.js';
/**
 * Local KMS specific error
 */
export declare class LocalKMSError extends VorionError {
    code: string;
    statusCode: number;
    constructor(message: string, code?: string, details?: Record<string, unknown>);
}
/**
 * Local KMS Provider for development and testing
 *
 * WARNING: This provider is NOT suitable for production use!
 *
 * @example
 * ```typescript
 * const provider = new LocalKMSProvider({
 *   provider: 'local',
 *   keyEnvVar: 'VORION_LOCAL_KMS_KEY',
 * });
 *
 * await provider.initialize();
 *
 * // Generate data key for envelope encryption
 * const dataKey = await provider.generateDataKey();
 * ```
 */
export declare class LocalKMSProvider implements KMSProvider {
    readonly name = "local";
    private readonly config;
    private keyStore;
    private dataKeyCache;
    private readonly auditCallbacks;
    private initialized;
    constructor(config: LocalKMSConfig);
    /**
     * Initialize the local KMS provider
     */
    initialize(): Promise<void>;
    /**
     * Shutdown the provider
     */
    shutdown(): Promise<void>;
    /**
     * Register an audit callback
     */
    onAudit(callback: KMSAuditCallback): void;
    /**
     * Emit audit event
     */
    private emitAudit;
    /**
     * Check provider health
     */
    healthCheck(): Promise<boolean>;
    /**
     * Ensure provider is initialized
     */
    private ensureInitialized;
    /**
     * Load or generate the master key
     */
    private loadOrGenerateMasterKey;
    /**
     * Get the current master key
     */
    private getCurrentKey;
    /**
     * Get a specific key version
     */
    private getKeyVersion;
    /**
     * Get key metadata
     */
    getKey(keyId: string): Promise<KeyMetadata | null>;
    /**
     * List all keys
     */
    listKeys(_options?: ListKeysOptions): Promise<KeyMetadata[]>;
    /**
     * Encrypt data
     */
    encrypt(plaintext: Buffer, options?: KMSEncryptOptions): Promise<EncryptResult>;
    /**
     * Decrypt data
     */
    decrypt(ciphertext: Buffer, options?: KMSDecryptOptions): Promise<DecryptResult>;
    /**
     * Generate a data key for envelope encryption
     */
    generateDataKey(options?: GenerateDataKeyOptions): Promise<DataKey>;
    /**
     * Decrypt a data key
     */
    decryptDataKey(encryptedDataKey: Buffer, options?: KMSDecryptOptions): Promise<Buffer>;
    /**
     * Rotate the key
     */
    rotateKey(_keyId: string): Promise<KeyRotationResult>;
    /**
     * Get rotation schedule (not supported for local provider)
     */
    getRotationSchedule(_keyId: string): Promise<KeyRotationSchedule>;
    /**
     * Get cache statistics
     */
    getCacheStats(): {
        size: number;
        ttlMs: number;
        maxUsages: number;
    } | null;
}
//# sourceMappingURL=local.d.ts.map