import type { CredentialService } from '@pikku/core/services';
import type { Kysely } from 'kysely';
import type { KyselyPikkuDB } from './kysely-tables.js';
export interface KyselyCredentialServiceConfig {
    key: string;
    keyVersion?: number;
    previousKey?: string;
    audit?: boolean;
    auditReads?: boolean;
}
export declare class KyselyCredentialService implements CredentialService {
    private db;
    private initialized;
    private kekSalts;
    private keks;
    private key;
    private keyVersion;
    private previousKey?;
    private audit;
    private auditReads;
    constructor(db: Kysely<KyselyPikkuDB>, config: KyselyCredentialServiceConfig);
    init(): Promise<void>;
    private logAudit;
    private getKEKSalt;
    private getKEK;
    private whereUserId;
    get<T = unknown>(name: string, userId?: string): Promise<T | null>;
    set(name: string, value: unknown, userId?: string): Promise<void>;
    delete(name: string, userId?: string): Promise<void>;
    has(name: string, userId?: string): Promise<boolean>;
    getAll(userId: string): Promise<Record<string, unknown>>;
    getUsersWithCredential(name: string): Promise<string[]>;
    getAllUsers(): Promise<string[]>;
    rotateKEK(): Promise<number>;
}