import { SmrtObjectOptions, SmrtObject } from '@happyvertical/smrt-core';
/**
 * Secret status values
 */
export type SecretStatus = 'active' | 'disabled' | 'expired';
/**
 * Constructor options for {@link Secret}. Each field is optional and mirrors a
 * persisted column; date fields also accept the serialized forms accepted by
 * `new Date()` so hydrated rows coerce cleanly.
 */
export interface SecretOptions extends SmrtObjectOptions {
    tenantId?: string;
    name?: string;
    description?: string;
    category?: string;
    encryptedValue?: string;
    keyVersion?: number;
    status?: SecretStatus;
    expiresAt?: Date | string | number | null;
    lastAccessedAt?: Date | string | number | null;
    accessCount?: number;
    metadata?: Record<string, unknown>;
}
/**
 * Secret represents an encrypted value stored per-tenant.
 *
 * Secrets are tenant-scoped and use envelope encryption:
 * - Each tenant has their own Data Encryption Key (TDEK)
 * - The TDEK is wrapped by the Application Master Key (AMK)
 * - Secret values are encrypted by the unwrapped TDEK
 *
 * **Security**: This model deliberately excludes API and MCP exposure
 * to prevent accidental secret leakage. Secrets are only accessible
 * via CLI commands or direct service calls.
 *
 * @example
 * ```typescript
 * import { SecretService } from '@happyvertical/smrt-secrets';
 *
 * const service = await SecretService.create({ db });
 *
 * await withTenant({ tenantId: 'tenant-123' }, async () => {
 *   // Store a secret
 *   await service.store('api-key', 'sk_live_xxx', { category: 'stripe' });
 *
 *   // Retrieve (auto-decrypts)
 *   const apiKey = await service.retrieve('api-key');
 * });
 * ```
 */
export declare class Secret extends SmrtObject {
    /**
     * Tenant that owns this secret. Also stored in context for per-tenant name uniqueness.
     */
    tenantId: string;
    /**
     * Unique name for the secret within the tenant
     */
    name: string;
    /**
     * Human-readable description
     */
    description: string;
    /**
     * Category for organization (e.g., 'database', 'api-key', 'oauth')
     */
    category: string;
    /**
     * JSON-encoded EncryptedEnvelope from @happyvertical/secrets
     */
    encryptedValue: string;
    /**
     * Version of the tenant key used to encrypt this secret
     */
    keyVersion: number;
    /**
     * Current status of the secret
     */
    status: SecretStatus;
    /**
     * Optional expiration date
     */
    expiresAt: Date | null;
    /**
     * Last time this secret was accessed (decrypted)
     */
    lastAccessedAt: Date | null;
    /**
     * Number of times this secret has been accessed
     */
    accessCount: number;
    /**
     * Additional metadata stored with the secret
     */
    metadata: Record<string, unknown>;
    constructor(options?: SecretOptions);
    /**
     * Check if the secret is currently active
     */
    isActive(): boolean;
    /**
     * Check if the secret has expired
     */
    isExpired(): boolean;
    /**
     * Check if the secret can be used (active and not expired)
     */
    isUsable(): boolean;
    /**
     * Record an access to this secret
     */
    recordAccess(): void;
    /**
     * Disable the secret
     */
    disable(): void;
    /**
     * Enable the secret
     */
    enable(): void;
}
//# sourceMappingURL=Secret.d.ts.map