/**
 * EncryptionLayer -- AES-256-GCM encryption for data at rest.
 *
 * AIAG-014 STATUS: Sole owner of at-rest AES-256-GCM. EncryptedStorage
 * delegates here; no other module should call `crypto.createCipheriv`
 * directly. Two formats coexist:
 *
 *   V2 (current, preferred): uses KeyManager for key material. HKDF
 *   derivation with a random persisted salt (AIAG-016). Format:
 *     CONNEXUM-ENC-V2 | keyVersion(4B) | iv(12B) | tag(16B) | ciphertext
 *
 *   V1 (deprecated, read-only after V2 migration complete): passphrase
 *   + PBKDF2 (100k iterations) + per-file random salt. Format:
 *     CONNEXUM-ENC-V1 | salt(32B) | iv(12B) | tag(16B) | ciphertext
 *
 * New code MUST pass `keyManager` so V2 is selected. V1 remains only
 * so callers without KeyManager (test fixtures, legacy file reads)
 * continue to work until the ecosystem finishes migrating.
 *
 * Encrypts audit logs, session state, memory files, and any
 * governance data before writing to disk. Decrypts on read.
 *
 * Required by:
 *   - HIPAA 164.312(a)(2)(iv): Encryption and decryption
 *   - GDPR Art. 32: Security of processing
 *   - PCI DSS Req 3: Protect stored data
 *   - SOC 2 CC6.1: Logical and physical access
 *   - ISO 27001 8.24: Use of cryptography
 *
 * @connexum/ai-governance
 */
import type { KeyManager } from './key-manager';
export interface EncryptionConfig {
    /** Master passphrase for key derivation (fallback if no keyManager) */
    passphrase: string;
    /** Directory for encryption logs */
    logDir?: string;
    /** PBKDF2 iterations (default: 100000) */
    iterations?: number;
    /** KeyManager for centralized key management and rotation (recommended) */
    keyManager?: KeyManager;
}
export interface EncryptResult {
    success: boolean;
    path: string;
    originalSize: number;
    encryptedSize: number;
    error?: string;
}
export interface DecryptResult {
    success: boolean;
    content: Buffer;
    error?: string;
}
export declare class EncryptionLayer {
    private passphrase;
    private iterations;
    private logDir;
    private keyManager?;
    constructor(config: EncryptionConfig);
    /**
     * Encrypt a buffer using AES-256-GCM.
     * Uses KeyManager (V2) when available, falls back to passphrase (V1).
     */
    encrypt(plaintext: Buffer): Buffer;
    /**
     * Decrypt a buffer. Handles:
     *   - CONNEXUM-ENC-V2 (current, KeyManager-backed)
     *   - CONNEXUM-ENC-V1 (current, passphrase + PBKDF2)
     *   - CXENC2 (legacy, KeyManager-backed; pre-AIAG-014)
     *   - CXENC1 (legacy, passphrase + PBKDF2; pre-AIAG-014)
     */
    decrypt(data: Buffer): DecryptResult;
    /**
     * Encrypt a string and return as a buffer.
     */
    encryptString(plaintext: string): Buffer;
    /**
     * Decrypt a buffer and return as a string.
     */
    decryptString(data: Buffer): string | null;
    /**
     * Encrypt a file in place. Creates .bak backup first.
     */
    encryptFile(filePath: string): EncryptResult;
    /**
     * Decrypt a file in place.
     */
    decryptFile(filePath: string): EncryptResult;
    /**
     * Check if a buffer is encrypted with our format (V1 or V2).
     */
    isEncrypted(data: Buffer): boolean;
    /**
     * Check if a file on disk is encrypted (V1 or V2).
     */
    isFileEncrypted(filePath: string): boolean;
    /**
     * Read an encrypted file, decrypt, and return content as string.
     * If file is not encrypted, returns content as-is.
     */
    readEncrypted(filePath: string): string | null;
    /**
     * Write content encrypted to a file.
     */
    writeEncrypted(filePath: string, content: string): void;
    /**
     * Append to an encrypted JSONL file.
     * Reads existing content, decrypts, appends line, re-encrypts.
     */
    appendEncryptedJsonl(filePath: string, entry: Record<string, unknown>): void;
    private deriveKey;
    private logOperation;
}
//# sourceMappingURL=encryption-layer.d.ts.map