/**
 * EncryptedStorage -- Transparent encryption for governance file storage.
 *
 * DELEGATES all cryptographic operations to EncryptionLayer (AIAG-014).
 * This class provides the file-oriented convenience API (writeEncrypted,
 * readEncrypted, JSONL helpers) while EncryptionLayer owns the single
 * AES-256-GCM implementation.
 *
 * Backwards compatible: reads legacy CXENC1/CXENC2 format files and
 * re-encrypts them in the unified CONNEXUM-ENC format on next write.
 *
 * T-032: Encrypt audit logs at rest.
 * T-034: Encrypt memory files at rest.
 *
 * @connexum/ai-governance
 */
import { EncryptionLayer } from './encryption-layer';
import type { KeyManager } from './key-manager';
export interface EncryptedStorageConfig {
    /** Master passphrase for encryption (used as fallback if no keyManager) */
    passphrase: string;
    /** Enable encryption (default: true, can disable for dev) */
    enabled?: boolean;
    /** KeyManager for centralized key management and rotation (recommended) */
    keyManager?: KeyManager;
}
export declare class EncryptedStorage {
    private passphrase;
    private enabled;
    private keyManager?;
    private encryptionLayer;
    constructor(config: EncryptedStorageConfig);
    /**
     * Write data encrypted to a file.
     * Uses the unified EncryptionLayer (CONNEXUM-ENC-V1/V2 format).
     */
    writeEncrypted(filePath: string, data: string): void;
    /**
     * Read and decrypt a file.
     * Handles legacy CXENC1/CXENC2 formats AND unified CONNEXUM-ENC formats.
     */
    readEncrypted(filePath: string): string;
    /**
     * Append an encrypted JSONL entry.
     * Note: For JSONL, we re-read, append, and re-encrypt the whole file.
     * This ensures the entire file remains a single encrypted blob.
     */
    appendEncryptedJsonl(filePath: string, entry: unknown): void;
    /**
     * Read all JSONL entries from an encrypted file.
     */
    readEncryptedJsonl<T = unknown>(filePath: string): T[];
    /**
     * Write JSON object encrypted.
     */
    writeEncryptedJson(filePath: string, data: unknown): void;
    /**
     * Read encrypted JSON object.
     */
    readEncryptedJson<T = unknown>(filePath: string): T | null;
    /**
     * Check if a file is encrypted (legacy CXENC or unified CONNEXUM-ENC format).
     */
    isEncrypted(filePath: string): boolean;
    /**
     * Encrypt an existing plaintext file in place.
     * Uses the unified EncryptionLayer format (migrates from legacy on write).
     */
    encryptFile(filePath: string): boolean;
    /**
     * Decrypt an encrypted file in place (for migration/debug).
     */
    decryptFile(filePath: string): boolean;
    /**
     * Get the underlying EncryptionLayer for direct buffer operations.
     * Exposed for modules that need buffer-level crypto without file I/O.
     */
    getEncryptionLayer(): EncryptionLayer;
}
//# sourceMappingURL=encrypted-storage.d.ts.map