import { SecretValue as SecretValue$1 } from "../secret-value.js";
import { SecretMetadata, SecretValue, SecretsSetOptions, SecretsStore } from "@graphorin/core/contracts";
import { SessionScope } from "@graphorin/core/types";

//#region src/secrets/stores/encrypted-file.d.ts

/**
 * Options for `EncryptedFileSecretsStore`.
 *
 * @stable
 */
interface EncryptedFileSecretsStoreOptions {
  /** Absolute path to the bundle file. Tilde expansion supported. */
  readonly path: string;
  /** Passphrase wrapped in a `SecretValue`. */
  readonly passphrase: SecretValue$1;
  /**
   * Whether to enforce mode `0o600` on the bundle when writing. The
   * default (`true`) is the recommended configuration; tests on
   * platforms without POSIX mode bits opt out.
   */
  readonly enforcePermissions?: boolean;
}
/**
 * `SecretsStore` backed by an AES-256-GCM bundle on disk.
 *
 * @stable
 */
declare class EncryptedFileSecretsStore implements SecretsStore {
  #private;
  readonly kind: "encrypted-file";
  constructor(opts: EncryptedFileSecretsStoreOptions);
  get(key: string, _scope?: SessionScope): Promise<SecretValue$1 | null>;
  require(key: string, _scope?: SessionScope): Promise<SecretValue$1>;
  set(key: string, value: string | SecretValue, opts?: SecretsSetOptions): Promise<void>;
  delete(key: string, _scope?: SessionScope): Promise<void>;
  /**
   * Re-encrypt the whole bundle under a new passphrase.
   *
   * Reads the bundle with the current passphrase (a wrong passphrase or
   * a tampered bundle fails the GCM auth check and propagates), then
   * atomically rewrites it keyed from `newPassphrase`. Every write uses
   * a fresh random salt and nonce, so a rekey also rotates the KDF
   * salt. On success the instance switches to the new passphrase for
   * all subsequent operations.
   *
   * The store takes no ownership of either `SecretValue`: it disposes
   * neither the old nor the new passphrase - lifecycle stays with the
   * caller. A missing bundle file propagates as `ENOENT` (there is
   * nothing to rekey; `set()` a first secret instead).
   *
   * @stable
   */
  rekey(newPassphrase: SecretValue$1): Promise<void>;
  list(_scope?: SessionScope): Promise<ReadonlyArray<SecretMetadata>>;
}
//#endregion
export { EncryptedFileSecretsStore, EncryptedFileSecretsStoreOptions };
//# sourceMappingURL=encrypted-file.d.ts.map