import { ApplicationMasterKey, DatabaseSecretStoreOptions, DecryptedSecret, EncryptedEnvelope, EncryptOptions, SecretStore, SecretStoreEventListener, TenantDataEncryptionKey, Unsubscribe } from '../shared/types.js';
/**
 * Database-backed secret store
 *
 * Uses envelope encryption with AES-256-GCM:
 * - Application Master Key (AMK) from environment variable
 * - Per-tenant Data Encryption Keys (TDEKs) wrapped by AMK
 * - Secrets encrypted by unwrapped TDEKs
 *
 * @example
 * ```typescript
 * const store = new DatabaseSecretStore({
 *   type: 'database',
 *   db,
 *   amk: {
 *     provider: 'env',
 *     keyEnvVar: 'SECRET_MASTER_KEY',
 *     keyId: 'amk-v1'
 *   }
 * });
 *
 * await store.initialize();
 *
 * // Encrypt a secret for a tenant
 * const envelope = await store.encrypt('tenant-123', 'api-key', 'synthetic-secret');
 *
 * // Decrypt
 * const { value } = await store.decrypt('tenant-123', envelope);
 * ```
 */
export declare class DatabaseSecretStore implements SecretStore {
    private db;
    private keysTable;
    private amkConfig;
    private cachedAmk;
    private initialized;
    private listeners;
    constructor(options: DatabaseSecretStoreOptions);
    /**
     * Initialize the store (create schema if needed)
     */
    initialize(): Promise<void>;
    /**
     * Get the Application Master Key from environment
     */
    private getAMK;
    /**
     * Ensure the store is initialized
     */
    private ensureInitialized;
    /**
     * Emit an event to all listeners
     */
    private emitEvent;
    /**
     * Subscribe to store events
     */
    subscribe(listener: SecretStoreEventListener): Unsubscribe;
    encrypt(tenantId: string, secretName: string, plaintext: string, options?: EncryptOptions): Promise<EncryptedEnvelope>;
    decrypt(tenantId: string, envelope: EncryptedEnvelope): Promise<DecryptedSecret>;
    getTenantKey(tenantId: string): Promise<TenantDataEncryptionKey | null>;
    createTenantKey(tenantId: string): Promise<TenantDataEncryptionKey>;
    rotateTenantKey(tenantId: string): Promise<TenantDataEncryptionKey>;
    retireTenantKey(tenantId: string, keyId: string): Promise<void>;
    getActiveAMK(): Promise<ApplicationMasterKey>;
    rewrapTenantKey(_tenantId: string, _newAmkKeyId: string): Promise<TenantDataEncryptionKey>;
    listKeyVersions(tenantId: string): Promise<TenantDataEncryptionKey[]>;
    /**
     * Parse a database row into a TenantDataEncryptionKey
     */
    private parseKeyRow;
}
export default DatabaseSecretStore;
//# sourceMappingURL=database.d.ts.map