/**
 * Encrypted value with key version tracking.
 * The data field contains base64-encoded IV || AuthTag || Ciphertext.
 */
export interface EncryptedValue {
    /** Base64-encoded IV + auth tag + ciphertext. */
    data: string;
    /** Version of the encryption key used. */
    keyVersion: number;
}
/**
 * Encrypt a plaintext string using AES-256-GCM with AAD.
 *
 * @param plaintext - The string to encrypt
 * @param key - 32-byte encryption key
 * @param keyVersion - Version number for key rotation tracking
 * @param aad - Additional authenticated data (e.g., "contextId:keyName")
 * @returns Encrypted value with key version
 */
export declare function encrypt(plaintext: string, key: Buffer, keyVersion: number, aad: string): EncryptedValue;
/**
 * Decrypt an encrypted value using AES-256-GCM with AAD verification.
 *
 * @param encrypted - The encrypted value to decrypt
 * @param key - 32-byte encryption key (must match the key used for encryption)
 * @param aad - Additional authenticated data (must match the AAD used for encryption)
 * @returns Decrypted plaintext string
 * @throws If decryption fails (wrong key, wrong AAD, tampered data)
 */
export declare function decrypt(encrypted: EncryptedValue, key: Buffer, aad: string): string;
/**
 * Derive a 32-byte encryption key from a string input.
 *
 * Accepts two formats:
 * - 64-character hex string (e.g., from generateMasterKey())
 * - Base64-encoded 32-byte key
 *
 * @param input - Hex or base64 encoded key material
 * @returns 32-byte Buffer suitable for use with encrypt/decrypt
 * @throws If the derived key is not exactly 32 bytes
 */
export declare function deriveKey(input: string): Buffer;
/**
 * Generate a new random 32-byte master key as a hex string.
 *
 * @returns 64-character hex string suitable for KICI_SECRET_KEY env var
 */
export declare function generateMasterKey(): string;
//# sourceMappingURL=crypto.d.ts.map