/**
 * GCP Cloud KMS provider.
 *
 * Edge-compatible: uses Web Crypto API for JWT signing and fetch() for GCP API
 * calls. No Node.js dependencies — works in Cloudflare Workers.
 */
import type { KeyRef, KmsDataKey, KmsKeyType, KmsProvider, KmsUnwrappedDataKey } from "./kms.js";
export interface GcpKmsConfig {
    projectId: string;
    serviceAccountEmail: string;
    privateKeyPem: string;
    /** GCP keyring name. Keyrings are location-bound — one provider, one keyring. */
    keyRing: string;
    /** GCP location the keyring lives in, e.g. "europe", "us", "global", "europe-west1". */
    location: string;
    cryptoKeyByType: Record<KmsKeyType, string>;
}
export declare class GcpKmsProvider implements KmsProvider {
    private readonly config;
    readonly name: "gcp";
    private cachedToken;
    constructor(config: GcpKmsConfig);
    private getKeyName;
    /**
     * Creates a signed JWT assertion and exchanges it at Google's OAuth2
     * endpoint for a short-lived access token. Caches the token per instance.
     */
    private getAccessToken;
    encrypt(plaintext: string, key: KeyRef): Promise<string>;
    decrypt(ciphertext: string, key: KeyRef): Promise<string>;
    generateDataKey(key: KeyRef): Promise<KmsDataKey>;
    unwrap(key: KeyRef, wrappedDek: string): Promise<KmsUnwrappedDataKey>;
}
//# sourceMappingURL=kms-gcp.d.ts.map