import type { SecretService, SecretValues } from '@pikku/core/services';
import type { SecretValue } from '@pikku/core/classification';
import type { Kysely } from 'kysely';
import type { KyselyPikkuDB } from './kysely-tables.js';
export interface KyselySecretServiceConfig {
    key: string;
    keyVersion?: number;
    previousKey?: string;
    audit?: boolean;
    auditReads?: boolean;
}
export declare class KyselySecretService implements SecretService {
    private db;
    private initialized;
    private kekSalts;
    private keks;
    private key;
    private keyVersion;
    private previousKey?;
    private audit;
    private auditReads;
    constructor(db: Kysely<KyselyPikkuDB>, config: KyselySecretServiceConfig);
    init(): Promise<void>;
    private logAudit;
    private getKEKSalt;
    private getKEK;
    getSecret<T = string>(key: string): Promise<SecretValue<T>>;
    hasSecret(key: string): Promise<boolean>;
    setSecret(key: string, value: unknown): Promise<void>;
    deleteSecret(key: string): Promise<void>;
    getSecrets<T extends Record<string, unknown> = Record<string, unknown>>(keys: (keyof T & string)[]): Promise<Partial<SecretValues<T>>>;
    rotateKEK(): Promise<number>;
}