import { SmrtObjectOptions, SmrtObject } from '@happyvertical/smrt-core';
/**
 * Key status values
 */
export type TenantKeyStatus = 'active' | 'rotating' | 'retired' | 'compromised';
/**
 * Constructor options for {@link TenantKey}. Each field is optional and mirrors
 * a persisted column; date fields also accept the serialized forms accepted by
 * `new Date()` so hydrated rows coerce cleanly.
 */
export interface TenantKeyOptions extends SmrtObjectOptions {
    tenantId?: string;
    wrappedKey?: string;
    amkKeyId?: string;
    status?: TenantKeyStatus;
    version?: number;
    rotateAfter?: Date | string | number | null;
    retiredAt?: Date | string | number | null;
}
/**
 * TenantKey tracks the per-tenant Data Encryption Keys (TDEKs).
 *
 * Each tenant has one or more TDEKs stored in wrapped form. The wrapped key
 * can only be decrypted using the Application Master Key (AMK).
 *
 * **Key Lifecycle**:
 * 1. `active` - Current key used for encryption
 * 2. `rotating` - Transitional state during rotation
 * 3. `retired` - Old key kept for decryption of existing secrets
 * 4. `compromised` - Key marked as compromised, should not be used
 *
 * **Note**: This model is NOT tenant-scoped itself because it tracks
 * keys FOR tenants, not secrets owned BY tenants.
 *
 * @example
 * ```typescript
 * // Get active key for a tenant
 * const key = await tenantKeys.get({
 *   tenantId: 'tenant-123',
 *   status: 'active'
 * });
 *
 * // List all key versions for a tenant
 * const versions = await tenantKeys.list({
 *   where: { tenantId: 'tenant-123' },
 *   orderBy: 'version DESC'
 * });
 * ```
 */
export declare class TenantKey extends SmrtObject {
    /**
     * Tenant ID this key belongs to
     */
    tenantId: string;
    /**
     * Wrapped key data (format: wrappedKey:iv:authTag)
     */
    wrappedKey: string;
    /**
     * ID of the AMK used to wrap this key
     */
    amkKeyId: string;
    /**
     * Current status of the key
     */
    status: TenantKeyStatus;
    /**
     * Version number (increments on rotation)
     */
    version: number;
    /**
     * Recommended rotation date
     */
    rotateAfter: Date | null;
    /**
     * When the key was retired (if applicable)
     */
    retiredAt: Date | null;
    constructor(options?: TenantKeyOptions);
    /**
     * Check if this key is currently active
     */
    isActive(): boolean;
    /**
     * Check if this key needs rotation
     */
    needsRotation(): boolean;
    /**
     * Check if this key is retired
     */
    isRetired(): boolean;
    /**
     * Check if this key is compromised
     */
    isCompromised(): boolean;
    /**
     * Check if this key can be used for decryption
     * (active or retired keys can decrypt)
     */
    canDecrypt(): boolean;
    /**
     * Check if this key can be used for encryption
     * (only active keys should encrypt)
     */
    canEncrypt(): boolean;
    /**
     * Mark this key as retired
     */
    retire(): void;
    /**
     * Mark this key as compromised
     */
    markCompromised(): void;
}
//# sourceMappingURL=TenantKey.d.ts.map