/**
 * Encrypted Elicitation Store
 *
 * Wraps an underlying ElicitationStore with session-based encryption.
 * All data is encrypted using session-derived keys before storage.
 *
 * Security Model:
 * - Pending records: encrypted with record.sessionId
 * - Fallback records: keyed by {sessionId}:{elicitId}, encrypted with sessionId
 * - Resolved results: keyed by {sessionId}:{elicitId}, encrypted with sessionId
 * - Pub/sub messages: encrypted with sessionId before publish
 *
 * Migration Support:
 * - Reads attempt decryption first, falls back to plaintext for migration
 * - All new writes are encrypted
 * - Old data expires via TTL (5-10 minutes)
 *
 * @module elicitation/store/encrypted-elicitation.store
 */
import type { FrontMcpLogger } from '../../common';
import type { ElicitationStore, PendingElicitRecord, ElicitResultCallback, ElicitUnsubscribe } from './elicitation.store';
import type { ElicitResult, PendingElicitFallback, ResolvedElicitResult, FallbackExecutionResult, FallbackResultCallback } from '../elicitation.types';
/**
 * Options for creating an encrypted elicitation store.
 */
export interface EncryptedElicitationStoreOptions {
    /**
     * Server secret for key derivation.
     * Falls back to env vars if not provided.
     */
    secret?: string;
    /**
     * Logger instance for store operations.
     */
    logger?: FrontMcpLogger;
}
/**
 * Encrypted wrapper around an ElicitationStore.
 *
 * Provides transparent encryption/decryption of all stored data using
 * session-derived keys. This ensures that:
 * 1. Data at rest is encrypted
 * 2. Only requests with the correct sessionId can decrypt
 * 3. Different sessions cannot access each other's data
 */
export declare class EncryptedElicitationStore implements ElicitationStore {
    private readonly store;
    private readonly secret?;
    private readonly logger?;
    constructor(store: ElicitationStore, options?: EncryptedElicitationStoreOptions);
    /**
     * Store a pending elicitation with encryption.
     * The record is encrypted using its own sessionId.
     */
    setPending(record: PendingElicitRecord): Promise<void>;
    /**
     * Get a pending elicitation by session ID.
     * Attempts decryption, falls back to plaintext for migration.
     */
    getPending(sessionId: string): Promise<PendingElicitRecord | null>;
    /**
     * Delete a pending elicitation by session ID.
     */
    deletePending(sessionId: string): Promise<void>;
    /**
     * Subscribe to elicitation results with decryption.
     */
    subscribeResult<T = unknown>(elicitId: string, callback: ElicitResultCallback<T>, sessionId?: string): Promise<ElicitUnsubscribe>;
    /**
     * Publish an elicitation result with encryption.
     */
    publishResult<T = unknown>(elicitId: string, sessionId: string, result: ElicitResult<T>): Promise<void>;
    /**
     * Store a pending elicitation fallback context with encryption.
     */
    setPendingFallback(record: PendingElicitFallback): Promise<void>;
    /**
     * Get a pending elicitation fallback by elicit ID.
     * Requires sessionId for decryption.
     */
    getPendingFallback(elicitId: string, sessionId?: string): Promise<PendingElicitFallback | null>;
    /**
     * Delete a pending elicitation fallback by elicit ID.
     */
    deletePendingFallback(elicitId: string): Promise<void>;
    /**
     * Store a resolved elicit result with encryption.
     */
    setResolvedResult(elicitId: string, result: ElicitResult<unknown>, sessionId?: string): Promise<void>;
    /**
     * Get a resolved elicit result by elicit ID.
     * Requires sessionId for decryption.
     */
    getResolvedResult(elicitId: string, sessionId?: string): Promise<ResolvedElicitResult | null>;
    /**
     * Delete a resolved elicit result by elicit ID.
     */
    deleteResolvedResult(elicitId: string): Promise<void>;
    /**
     * Subscribe to fallback execution results with decryption.
     */
    subscribeFallbackResult(elicitId: string, callback: FallbackResultCallback, sessionId?: string): Promise<ElicitUnsubscribe>;
    /**
     * Publish a fallback execution result with encryption.
     */
    publishFallbackResult(elicitId: string, sessionId: string, result: FallbackExecutionResult): Promise<void>;
    destroy(): Promise<void>;
    /**
     * Decrypt a pending record.
     */
    private decryptPendingRecord;
    /**
     * Decrypt a fallback record.
     */
    private decryptFallbackRecord;
    /**
     * Decrypt a resolved record.
     */
    private decryptResolvedRecord;
}
//# sourceMappingURL=encrypted-elicitation.store.d.ts.map