import { ConfigService } from '@nestjs/config';
export declare class EncryptionService {
    private readonly configService;
    private readonly logger;
    private readonly algorithm;
    private readonly encryptionKey;
    constructor(configService: ConfigService);
    /**
     * Resolve encryption key with 3-level fallback:
     * 1. Env var ENCRYPTION_KEY — K8s production (from Kubernetes Secret)
     * 2. File ~/.flui/encryption.key — local development (shared CLI/API)
     * 3. Error if neither is available
     */
    private resolveEncryptionKey;
    /**
     * Encrypt plaintext string using AES-256-GCM
     * @param plaintext String to encrypt
     * @returns Base64 encoded encrypted data (iv + authTag + encrypted)
     */
    encrypt(plaintext: string): string;
    /**
     * Decrypt encrypted string
     * @param encryptedData Base64 encoded encrypted data
     * @returns Decrypted plaintext
     */
    decrypt(encryptedData: string): string;
    generateRandomToken(length?: number): string;
    /**
     * Generate a secure K3s token for cluster authentication
     *
     * K3s accepts "short token" format: a simple password (minimum 10 characters)
     * We generate 128 characters using a mix of:
     * - Lowercase letters (a-z)
     * - Uppercase letters (A-Z)
     * - Numbers (0-9)
     * - Safe special characters (-_@.+:=)
     *
     * These characters are safe for use in bash scripts, YAML, and K3s configuration.
     *
     * Provides ~778 bits of entropy (practically unbreakable)
     *
     * @returns A 128-character secure token
     */
    generateK3sToken(): string;
    hashPassword(password: string): string;
    compareHash(plaintext: string, hash: string): boolean;
}
