/**
 * KMS provider interface and factory.
 *
 * Callers encrypt/decrypt opaque strings via a `KmsProvider` implementation.
 * The returned ciphertext is paired with the `{ enc: "..." }` envelope from
 * `@voyantjs/types/schemas/kms/envelope` when persisted.
 */
import type { KmsEncryptedEnvelope } from "@voyantjs/types/schemas/kms/envelope";
import type { z } from "zod";
import { type AwsKmsConfig, AwsKmsProvider } from "./kms-aws.js";
import { type EnvKmsConfig, EnvKmsProvider, generateEnvKmsKey } from "./kms-env.js";
import { type GcpKmsConfig, GcpKmsProvider } from "./kms-gcp.js";
import { generateLocalKmsKey, type LocalKmsConfig, LocalKmsProvider } from "./kms-local.js";
import { type VoyantCloudKmsConfig, VoyantCloudKmsProvider } from "./kms-voyant-cloud.js";
export type KmsKeyType = "people" | "integrations";
export interface KeyRef {
    keyType: KmsKeyType;
}
export interface KmsDataKey {
    dek: string;
    wrappedDek: string;
}
export interface KmsUnwrappedDataKey {
    dek: string;
}
export interface KmsProvider {
    /**
     * Provider identifier. Known values are "gcp", "aws", "env", "local", and
     * "voyant-cloud"; custom providers may use any string (the `(string & {})`
     * pattern keeps autocomplete for the known values without forbidding others).
     */
    readonly name: "gcp" | "aws" | "env" | "local" | "voyant-cloud" | (string & {});
    encrypt(plaintext: string, key: KeyRef): Promise<string>;
    decrypt(ciphertext: string, key: KeyRef): Promise<string>;
    generateDataKey?(key: KeyRef): Promise<KmsDataKey>;
    unwrap?(key: KeyRef, wrappedDek: string): Promise<KmsUnwrappedDataKey>;
}
export type KmsConfig = {
    provider: "gcp";
    gcp: GcpKmsConfig;
} | {
    provider: "aws";
    aws: AwsKmsConfig;
} | {
    provider: "env";
    env: EnvKmsConfig;
} | {
    provider: "local";
    local: LocalKmsConfig;
} | {
    provider: "voyant-cloud";
    voyantCloud: VoyantCloudKmsConfig;
} | {
    provider: "custom";
    custom: KmsProvider;
};
/**
 * Build a provider instance from a validated config object.
 *
 * Supply `{ provider: "custom", custom: <your KmsProvider> }` to plug in an
 * implementation that isn't built in (e.g. AWS KMS, HashiCorp Vault).
 */
export declare function createKmsProvider(config: KmsConfig): KmsProvider;
/**
 * Build a `KmsConfig` from an env-like object. Accepts CF Workers `c.env`,
 * Node `process.env`, or any plain object.
 *
 * Throws with a clear message if `KMS_PROVIDER` is unset/invalid or required
 * provider-specific vars are missing.
 */
export declare function kmsConfigFromEnv(env: Record<string, string | undefined>): KmsConfig;
export declare function createKmsProviderFromEnv(env: Record<string, string | undefined>): KmsProvider;
export declare function encryptJsonEnvelope<T>(provider: KmsProvider, key: KeyRef, value: T): Promise<KmsEncryptedEnvelope>;
export declare function decryptJsonEnvelope<T>(provider: KmsProvider, key: KeyRef, envelope: KmsEncryptedEnvelope, schema: z.ZodType<T>): Promise<T>;
export declare function encryptOptionalJsonEnvelope<T>(provider: KmsProvider, key: KeyRef, value: T | null | undefined): Promise<KmsEncryptedEnvelope | null>;
export declare function decryptOptionalJsonEnvelope<T>(provider: KmsProvider, key: KeyRef, envelope: KmsEncryptedEnvelope | null | undefined, schema: z.ZodType<T>): Promise<T | null>;
export type { AwsKmsConfig, EnvKmsConfig, GcpKmsConfig, LocalKmsConfig, VoyantCloudKmsConfig };
export { AwsKmsProvider, EnvKmsProvider, GcpKmsProvider, generateEnvKmsKey, generateLocalKmsKey, LocalKmsProvider, VoyantCloudKmsProvider, };
//# sourceMappingURL=kms.d.ts.map