import { VorionError } from '../../common/errors.js';
import type { KMSProvider, KeyMetadata, DataKey, KMSEncryptOptions, KMSDecryptOptions, GenerateDataKeyOptions, EncryptResult, DecryptResult, KeyRotationResult, KeyRotationSchedule, ListKeysOptions, AWSKMSConfig, KMSAuditCallback } from './types.js';
/**
 * AWS KMS specific error
 */
export declare class AWSKMSError extends VorionError {
    code: string;
    statusCode: number;
    constructor(message: string, code?: string, details?: Record<string, unknown>);
}
/**
 * AWS KMS Provider implementation
 *
 * @example
 * ```typescript
 * const provider = new AWSKMSProvider({
 *   provider: 'aws',
 *   region: 'us-west-2',
 *   keyArn: 'arn:aws:kms:us-west-2:123456789:key/abc-123',
 *   enableCaching: true,
 *   cacheTtlSeconds: 300,
 * });
 *
 * await provider.initialize();
 *
 * // Generate data key for envelope encryption
 * const dataKey = await provider.generateDataKey();
 *
 * // Use plaintext to encrypt data locally
 * const encrypted = localEncrypt(data, dataKey.plaintext);
 *
 * // Store encrypted data key with the encrypted data
 * store(encrypted, dataKey.ciphertext);
 *
 * // Clear plaintext from memory
 * dataKey.plaintext.fill(0);
 * ```
 */
export declare class AWSKMSProvider implements KMSProvider {
    readonly name = "aws";
    private readonly config;
    private client;
    private dataKeyCache;
    private readonly auditCallbacks;
    private initialized;
    constructor(config: AWSKMSConfig);
    /**
     * Initialize the AWS KMS provider
     */
    initialize(): Promise<void>;
    /**
     * Shutdown the provider
     */
    shutdown(): Promise<void>;
    /**
     * Register an audit callback
     */
    onAudit(callback: KMSAuditCallback): void;
    /**
     * Emit audit event
     */
    private emitAudit;
    /**
     * Check provider health
     */
    healthCheck(): Promise<boolean>;
    /**
     * Ensure provider is initialized
     */
    private ensureInitialized;
    /**
     * Get key metadata
     */
    getKey(keyId: string): Promise<KeyMetadata | null>;
    /**
     * List all keys
     */
    listKeys(options?: ListKeysOptions): Promise<KeyMetadata[]>;
    /**
     * Encrypt data
     */
    encrypt(plaintext: Buffer, options?: KMSEncryptOptions): Promise<EncryptResult>;
    /**
     * Decrypt data
     */
    decrypt(ciphertext: Buffer, options?: KMSDecryptOptions): Promise<DecryptResult>;
    /**
     * Generate a data key for envelope encryption
     */
    generateDataKey(options?: GenerateDataKeyOptions): Promise<DataKey>;
    /**
     * Decrypt a data key
     */
    decryptDataKey(encryptedDataKey: Buffer, options?: KMSDecryptOptions): Promise<Buffer>;
    /**
     * Rotate a key
     *
     * Note: AWS KMS automatically manages key rotation. This method
     * enables automatic rotation on the key.
     */
    rotateKey(keyId: string): Promise<KeyRotationResult>;
    /**
     * Get rotation schedule for a key
     */
    getRotationSchedule(keyId: string): Promise<KeyRotationSchedule>;
    /**
     * Enable automatic key rotation
     */
    enableAutoRotation(keyId: string, rotationPeriodDays?: number): Promise<void>;
    /**
     * Disable automatic key rotation
     */
    disableAutoRotation(keyId: string): Promise<void>;
    /**
     * Build a cache key from key ID and encryption context
     */
    private buildCacheKey;
    /**
     * Map AWS key metadata to our KeyMetadata type
     */
    private mapAWSKeyMetadata;
    /**
     * Map AWS key state to our KeyStatus type
     */
    private mapAWSKeyState;
    /**
     * Wrap errors in AWSKMSError
     */
    private wrapError;
    /**
     * Get cache statistics
     */
    getCacheStats(): {
        size: number;
        ttlMs: number;
        maxUsages: number;
    } | null;
}
//# sourceMappingURL=aws-kms.d.ts.map