import { CacheDriverInterface } from "../types.mjs";
import { PlainLocalStorageDriver } from "./PlainLocalStorageDriver.mjs";

//#region ../cache/src/drivers/EncryptedLocalStorageDriver.d.ts
declare class EncryptedLocalStorageDriver extends PlainLocalStorageDriver implements CacheDriverInterface {
  /**
   * Set data into storage engine
   *
   * Wraps the value in a `{data, expiresAt}` envelope (matching the
   * plain driver shape) BEFORE encrypting, so the encrypted variant
   * honors `expiresAfter` just like the plain drivers do.
   *
   * The configured `encrypt` is awaited: @mongez/encryption 2.x returns
   * a promise (WebCrypto AES-GCM cannot be synchronous), while 1.x
   * returned a string. `await` accepts both.
   */
  set(key: string, value: any, expiresAfter?: number): Promise<this>;
  /**
   * Get value from storage engine
   *
   * Decrypts then unwraps the `{data, expiresAt}` envelope and checks
   * expiry. For backward compatibility with legacy cyphers that were
   * written before the envelope was introduced (no `data` / `expiresAt`
   * keys), the decrypted value is returned as-is with no expiration.
   *
   * A cypher that fails to decrypt (tampered entry, rotated key,
   * truncated write) must not make every subsequent read throw, so the
   * poisoned entry is evicted and the default value is returned —
   * the same self-healing behavior `BaseCacheEngine.get()` implements.
   * With an authenticated cipher (AES-GCM) that eviction is also the
   * tamper response: a modified cypher fails the tag check, so it is
   * dropped rather than returned as data.
   */
  get(key: string, defaultValue?: any): Promise<any>;
  /**
   * Determine whether the cache engine has a live entry for the key
   *
   * Presence is decided without decrypting: the cypher is opaque, and
   * running the (now async) decrypt on every `has()` would leak both
   * CPU and, on a rotated key, entries — an eviction is a write, and a
   * read-shaped call should not silently rewrite storage. Expiry is
   * therefore enforced by `get()`, which has to decrypt anyway.
   */
  has(key: string): Promise<boolean>;
  /**
   * Remove key from storage
   */
  remove(key: string): Promise<this>;
}
//#endregion
export { EncryptedLocalStorageDriver };
//# sourceMappingURL=EncryptedLocalStorageDriver.d.mts.map