import { CacheDriverInterface } from "../types.mjs";
import { IndexedDBDriver } from "./IndexedDBDriver.mjs";

//#region ../cache/src/drivers/EncryptedIndexedDBDriver.d.ts
/**
 * IndexedDB driver whose payload is encrypted at rest.
 *
 * The whole `{data, expiresAt}` envelope is encrypted — the same shape
 * the encrypted Web Storage drivers write — so the expiry travels
 * *inside* the authenticated cypher and cannot be extended by anyone who
 * can write to the database.
 *
 * `expiresAt` is ALSO stored in the clear on the record, because the
 * driver has to evict expired entries without decrypting every row
 * (a rotated key would otherwise leave the database growing forever).
 * The two are checked in order, so the effective expiry is the earlier
 * of the two: pushing the plaintext copy further out buys an attacker
 * nothing, and pulling it in only evicts an entry they could have
 * deleted outright anyway. What the plaintext copy does leak is *when*
 * an entry expires — a session length, roughly. If that matters more
 * than unbounded growth on a stale key, set no TTL.
 */
declare class EncryptedIndexedDBDriver extends IndexedDBDriver implements CacheDriverInterface {
  /**
   * Set cache into storage
   */
  set(key: string, value: any, expiresAfter?: number): Promise<this>;
  /**
   * Get value from cache engine, if key does not exist return default value
   *
   * A cypher that fails to decrypt — tampered record, rotated key,
   * truncated write — is evicted and the default value returned, so one
   * poisoned row cannot make every later read throw. With AES-GCM the
   * failed authentication tag lands here too, which makes eviction the
   * tamper response as well.
   */
  get(key: string, defaultValue?: any): Promise<any>;
  /**
   * Read every live entry owned by this engine
   *
   * Overridden because the base implementation reads records in one
   * transaction and cannot `await` a decrypt inside it — the records
   * are collected first, then decrypted key by key through `get()`.
   */
  getAll(): Promise<Record<string, any>>;
}
//#endregion
export { EncryptedIndexedDBDriver };
//# sourceMappingURL=EncryptedIndexedDBDriver.d.mts.map