/**
 * Vault — Transparent encryption layer for Avis private data.
 *
 * All sensitive data (memories, sessions, conversation buffer, graphs,
 * voice profiles, etc.) is encrypted at rest with AES-256-GCM.
 *
 * The master key lives exclusively in macOS Keychain under the service
 * "one.kaio.avis.vault". Only the Avis process can retrieve it at
 * runtime. The key is never written to disk, never logged, never
 * included in any prompt or session file.
 *
 * Design:
 *   - First run: generate 256-bit random key → store in Keychain
 *   - Every read: detect vault header → decrypt transparently
 *   - Every write: encrypt → write with vault header
 *   - Migration: on init, encrypt any existing plaintext files
 *
 * File format (binary):
 *   [magic 4B: "AVIS"] [version 1B: 0x01] [iv 12B] [authTag 16B] [ciphertext ...]
 */
export declare class Vault {
    private _key;
    private _ready;
    /**
     * Initialize the vault. Must be called once at startup.
     * Generates a new master key on first run, or retrieves the
     * existing one from Keychain.
     */
    init(): void;
    /** Best-effort detection of the agent directory */
    private _findAgentDir;
    /** Check if any encrypted (AVIS-magic) files exist in the agent dir */
    private _hasEncryptedFiles;
    /** Whether the vault has been initialized with a key */
    get ready(): boolean;
    private assertReady;
    /** Encrypt a UTF-8 string and return the vault buffer */
    encryptString(plaintext: string): Buffer;
    /** Decrypt a vault buffer to a UTF-8 string */
    decryptToString(data: Buffer): string;
    /** Encrypt arbitrary binary data */
    encryptBuffer(plaintext: Buffer): Buffer;
    /** Decrypt to raw binary buffer */
    decryptBuffer(data: Buffer): Buffer;
    /** Check if a buffer or file content is vault-encrypted */
    isEncrypted(data: Buffer): boolean;
    /**
     * Read a file, decrypting transparently if it's a vault file.
     * Returns the plaintext content as a UTF-8 string.
     */
    readFileSync(filePath: string): string;
    /**
     * Read a file as raw buffer, decrypting if vault-encrypted.
     */
    readFileBinarySync(filePath: string): Buffer;
    /**
     * Write encrypted content to a file.
     * Creates parent directories and sets restrictive permissions.
     */
    writeFileSync(filePath: string, content: string): void;
    /**
     * Write encrypted binary content to a file.
     */
    writeFileBinarySync(filePath: string, content: Buffer): void;
    /**
     * Append a line to a vault-encrypted file (e.g., memory.jsonl, session .jsonl).
     *
     * Since we can't append to AES-GCM ciphertext, this:
     *   1. Reads + decrypts the existing content
     *   2. Appends the new line
     *   3. Re-encrypts the whole file
     *
     * This is safe because session/memory files are small (<1MB typically)
     * and writes are infrequent relative to reads.
     */
    appendFileSync(filePath: string, line: string): void;
    /**
     * Async version of readFileSync for vault files.
     */
    readFileAsync(filePath: string): Promise<string>;
    /**
     * Async version of writeFileSync for vault files.
     */
    writeFileAsync(filePath: string, content: string): Promise<void>;
    /**
     * Encrypt a single plaintext file in-place.
     * Skips files that are already encrypted.
     */
    migrateFile(filePath: string): boolean;
    /**
     * Recursively encrypt all files in a directory.
     * Returns the number of files migrated.
     */
    migrateDirectory(dirPath: string, opts?: {
        extensions?: string[];
    }): number;
    /**
     * Migrate all known Avis data directories.
     * Called once at startup to encrypt any plaintext remnants.
     */
    migrateAll(agentDir: string): {
        migrated: number;
        errors: string[];
    };
}
/** Global vault instance — initialized once at Avis boot */
export declare const vault: Vault;
//# sourceMappingURL=vault.d.ts.map