/**
 * Credential encryption — AES-256-GCM with machine-bound key derivation.
 *
 * API keys (`sk_live_*`) are encrypted at rest in SQLite using AES-256-GCM.
 * The encryption key is derived per-project from a machine-specific secret:
 *
 *   machine-key (32 random bytes at ~/.local/share/cleo/machine-key)
 *   + project path
 *   = HMAC-SHA256(machine-key, project-path) → per-project AES key
 *
 * This means credentials are bound to BOTH the machine AND the project.
 * Moving `.cleo/tasks.db` to another machine renders stored keys unreadable.
 *
 * @see docs/specs/SIGNALDOCK-UNIFIED-AGENT-REGISTRY.md Section 3.6
 * @module crypto/credentials
 */
/**
 * Encrypt a plaintext string using AES-256-GCM with a per-project key.
 *
 * Output format: base64(version + iv + ciphertext + authTag)
 *   - version: 1 byte (0x01 = AES-256-GCM)
 *   - iv: 12 bytes
 *   - ciphertext: variable length
 *   - authTag: 16 bytes
 *
 * @param plaintext - The string to encrypt (e.g. an API key).
 * @param projectPath - Absolute path to the project directory (used for key derivation).
 * @returns Base64-encoded ciphertext.
 */
export declare function encrypt(plaintext: string, projectPath: string): Promise<string>;
/**
 * Decrypt a base64-encoded ciphertext using AES-256-GCM with a per-project key.
 *
 * @param ciphertext - Base64-encoded string from `encrypt()`.
 * @param projectPath - Absolute path to the project directory (must match the one used for encryption).
 * @returns The original plaintext string.
 * @throws If decryption fails (wrong key, corrupted data, or machine key mismatch).
 */
export declare function decrypt(ciphertext: string, projectPath: string): Promise<string>;
//# sourceMappingURL=credentials.d.ts.map