/**
 * AES-256-GCM encryption for vault secrets with AWS KMS envelope encryption.
 *
 * How it works:
 * 1. KMS generates a data key (plaintext + encrypted copy)
 * 2. We encrypt secrets locally with the plaintext data key (AES-256-GCM)
 * 3. The plaintext data key is cached in memory only (never on disk)
 * 4. The encrypted data key is stored at ~/.hasna/secrets/vault.key.enc
 * 5. On startup, KMS decrypts the data key back into memory
 *
 * Fallback: If KMS is not configured, uses a local key file (vault.key).
 *
 * Encrypted values: "enc:v1:<iv-hex>:<ciphertext+tag-hex>"
 * Plaintext values (legacy) lack the "enc:" prefix — transparently migrated.
 */
/**
 * Get the master key. Priority:
 * 1. In-memory cache
 * 2. KMS envelope encryption (vault.key.enc)
 * 3. Local key file (vault.key) — fallback
 */
export declare function getMasterKey(): Buffer;
/**
 * Initialize KMS configuration.
 */
export declare function initKms(keyId: string, region?: string, profile?: string): void;
/**
 * Check KMS status.
 */
export declare function getKeyStatus(): {
    mode: "kms" | "local" | "none";
    kmsKeyId?: string;
    keyPath: string;
    exists: boolean;
};
export declare function encrypt(plaintext: string): string;
export declare function decrypt(stored: string): string;
export declare function isEncrypted(value: string): boolean;
//# sourceMappingURL=crypto.d.ts.map