import { SecretClient } from '@azure/keyvault-secrets';
import { type ObjectWithKeysFromStringArray, SecretStoreBaseClass, type StoreBaseConfig } from '@purista/core';
import type { AzureSecretStoreConfig } from './types.js';
/**
 * Secret store backed by Azure Key Vault.
 *
 * Secret values are cached in memory after the first read to reduce Key Vault
 * calls. Set `enableCache` to `false` to always read from Azure, or set
 * `cacheTtl` in milliseconds to bound cache reuse. Expired entries are refreshed
 * on the next read.
 *
 * The store uses `DefaultAzureCredential`, so credentials should come from
 * managed identity, workload identity, Azure CLI login, or environment variables
 * supported by `@azure/identity`.
 *
 * Use Key Vault-compatible names that encode tenant and environment, for example
 * `acme-prod-payments-api-token`. Never log returned secret values.
 *
 * @example
 * ```typescript
 * const store = new AzureSecretStore({
 *   vaultUrl: 'https://example-vault.vault.azure.net',
 *   cacheTtl: 30_000,
 * })
 *
 * await store.setSecret('acme-prod-payments-api-token', 'placeholder-secret')
 * const secret = await store.getSecret('acme-prod-payments-api-token')
 * ```
 */
export declare class AzureSecretStore extends SecretStoreBaseClass<AzureSecretStoreConfig> {
    /**
     * Azure Key Vault client used for secret operations.
     *
     * Applications normally configure this through the constructor. Tests may
     * replace it with a compatible client.
     */
    client: SecretClient;
    /**
     * Creates an Azure Key Vault-backed secret store.
     *
     * @param config Store options and Azure Key Vault connection settings.
     */
    constructor(config: StoreBaseConfig<AzureSecretStoreConfig>);
    private isNotFoundError;
    protected getSecretImpl<SecretNames extends string[]>(...secretNames: SecretNames): Promise<ObjectWithKeysFromStringArray<SecretNames, string | undefined>>;
    protected removeSecretImpl(secretName: string): Promise<void>;
    protected setSecretImpl(secretName: string, secretValue: string): Promise<void>;
}
//# sourceMappingURL=AzureSecretStore.impl.d.ts.map