import { type LocalEncryptionProfileConfig } from "./config.js";
export declare const TODOS_ENCRYPTED_VALUE_KIND = "hasna.todos.encrypted-value";
export declare const TODOS_ENCRYPTED_BRIDGE_KIND = "hasna.todos.encrypted-bridge";
export declare const TODOS_ENCRYPTION_SCHEMA_VERSION = 1;
export declare const DEFAULT_ENCRYPTION_PROFILE = "default";
export declare const DEFAULT_ENCRYPTION_KEY_ENV = "TODOS_ENCRYPTION_KEY";
export interface LocalEncryptionEnvelope {
    schemaVersion: typeof TODOS_ENCRYPTION_SCHEMA_VERSION;
    kind: typeof TODOS_ENCRYPTED_VALUE_KIND;
    encryptedAt: string;
    profile: string;
    key_env: string;
    algorithm: "aes-256-gcm";
    kdf: "scrypt";
    salt: string;
    iv: string;
    auth_tag: string;
    ciphertext: string;
    plaintext_sha256: string;
}
export interface EncryptedLocalBridgeBundle {
    schemaVersion: typeof TODOS_ENCRYPTION_SCHEMA_VERSION;
    kind: typeof TODOS_ENCRYPTED_BRIDGE_KIND;
    encryptedAt: string;
    package: {
        packageName: "@hasna/todos";
        repository: "hasna/todos";
        version: string;
    };
    plaintext: {
        kind: string;
        schemaVersion: number;
        sha256: string;
    };
    encryption: Omit<LocalEncryptionEnvelope, "schemaVersion" | "kind" | "encryptedAt" | "plaintext_sha256">;
    warnings: string[];
}
export interface UpsertEncryptionProfileInput {
    name: string;
    key_env?: string;
    description?: string;
    salt?: string;
}
export declare class EncryptionKeyUnavailableError extends Error {
    readonly keyEnv: string;
    readonly profile: string;
    constructor(keyEnv: string, profile: string);
}
export declare class EncryptedPayloadError extends Error {
    constructor(message: string);
}
export declare function ensureEncryptionProfile(name?: string): LocalEncryptionProfileConfig;
export declare function listEncryptionProfiles(): LocalEncryptionProfileConfig[];
export declare function upsertEncryptionProfile(input: UpsertEncryptionProfileInput): LocalEncryptionProfileConfig;
export declare function removeEncryptionProfile(name: string): boolean;
export declare function encryptionProfileStatus(name?: string, env?: NodeJS.ProcessEnv): {
    profile: LocalEncryptionProfileConfig;
    locked: boolean;
    key_env: string;
    key_present: boolean;
};
export declare function encryptString(plaintext: string, options?: {
    profile?: string;
    env?: NodeJS.ProcessEnv;
    encryptedAt?: string;
}): LocalEncryptionEnvelope;
export declare function isEncryptedValue(value: unknown): value is LocalEncryptionEnvelope;
export declare function decryptString(envelope: LocalEncryptionEnvelope, env?: NodeJS.ProcessEnv): string;
export declare function encryptValue(value: unknown, options?: {
    profile?: string;
    env?: NodeJS.ProcessEnv;
}): LocalEncryptionEnvelope;
export declare function decryptValue<T = unknown>(envelope: LocalEncryptionEnvelope, env?: NodeJS.ProcessEnv): T;
export declare function looksSensitiveKey(key: string): boolean;
export declare function encryptSensitiveFields(value: unknown, options?: {
    profile?: string;
    env?: NodeJS.ProcessEnv;
}): unknown;
export declare function createEncryptedBridgeBundle(bundle: {
    kind: string;
    schemaVersion: number;
    package: {
        packageName: "@hasna/todos";
        repository: "hasna/todos";
        version: string;
    };
}, options?: {
    profile?: string;
    env?: NodeJS.ProcessEnv;
    encryptedAt?: string;
}): EncryptedLocalBridgeBundle;
export declare function isEncryptedBridgeBundle(value: unknown): value is EncryptedLocalBridgeBundle;
export declare function decryptBridgeBundle<T>(bundle: EncryptedLocalBridgeBundle, env?: NodeJS.ProcessEnv): T;
export type ExportProfile = "plaintext" | "redacted" | "encrypted";
export declare function assertExportProfileAllowed(profile: string): ExportProfile;
export declare function applyExportProfile(data: unknown, options?: {
    profile?: string;
    acknowledge_plaintext?: boolean;
    env?: NodeJS.ProcessEnv;
}): {
    profile: ExportProfile;
    data: unknown;
    warnings: string[];
};
//# sourceMappingURL=local-encryption.d.ts.map