/** Sentinel value used for redacted fields in display/export. */
export declare const REDACTED_VALUE = "***REDACTED***";
/**
 * Get a value at a nested path in an object.
 * Returns undefined if the path doesn't exist.
 *
 * @param obj - The object to traverse
 * @param path - Dot-separated path (e.g., 'providers.github.appId')
 */
export declare function deepGet(obj: Record<string, unknown>, path: string): unknown;
/**
 * Set a value at a nested path in an object.
 * Creates intermediate objects as needed.
 *
 * @param obj - The object to modify (mutated in place)
 * @param path - Dot-separated path (e.g., 'providers.github.appId')
 * @param value - The value to set
 */
export declare function deepSet(obj: Record<string, unknown>, path: string, value: unknown): void;
/**
 * Resolve a glob pattern path to concrete paths in an object.
 * Supports '*' as a wildcard for array indices or object keys at one level.
 *
 * Example: 'providers.github.*.privateKey' on an object where
 * providers.github is an array of 2 items resolves to:
 * ['providers.github.0.privateKey', 'providers.github.1.privateKey']
 *
 * @param obj - The object to inspect
 * @param pattern - Dot-separated path with optional '*' wildcards
 * @returns Array of concrete dot-separated paths that exist in the object
 */
export declare function resolveGlobPaths(obj: Record<string, unknown>, pattern: string): string[];
/**
 * Encrypt sensitive fields in a config object.
 *
 * Traverses each sensitive field path pattern, resolves glob wildcards,
 * and encrypts string values in place (in the cloned object).
 *
 * @param config - The config object to encrypt (not mutated)
 * @param paths - Array of field path patterns (may contain '*' wildcards)
 * @param key - 32-byte AES-256 encryption key
 * @param keyVersion - Master-key generation that encrypted these values.
 *   Stored alongside the ciphertext so rotation can identify and re-seal rows.
 * @returns Object with the encrypted config clone and list of actual encrypted paths
 */
export declare function encryptConfigFields(config: Record<string, unknown>, paths: string[], key: Buffer, keyVersion: number): {
    encrypted: Record<string, unknown>;
    encryptedPaths: string[];
};
/**
 * Decrypt sensitive fields in a config object.
 *
 * Uses the encrypted_paths array (stored alongside the config in the DB)
 * to know exactly which paths need decryption.
 *
 * Accepts an optional `oldKey` so rows encrypted under a previous master-key
 * generation continue to decrypt during the rotation grace window — matches
 * `PgSecretStore.decryptWithFallback`.
 *
 * @param config - The config object with encrypted fields (not mutated)
 * @param encryptedPaths - Array of concrete paths that contain encrypted values
 * @param key - Current 32-byte AES-256 encryption key
 * @param keyVersion - Generation stored alongside the row (carried into
 *   `EncryptedValue.keyVersion` so the crypto layer can surface key-mismatch
 *   telemetry; the AAD fully binds the ciphertext).
 * @param oldKey - Optional previous generation key, tried when the current
 *   key fails (undefined/null means no fallback).
 * @returns Decrypted config clone
 */
export declare function decryptConfigFields(config: Record<string, unknown>, encryptedPaths: string[], key: Buffer, keyVersion: number, oldKey?: Buffer | null): Record<string, unknown>;
/**
 * Redact sensitive fields in a config object for safe display.
 *
 * Replaces values at encrypted paths with '***REDACTED***'.
 * Used for CLI export and diff operations.
 *
 * @param config - The config object to redact (not mutated)
 * @param encryptedPaths - Array of concrete paths to redact
 * @returns Redacted config clone
 */
export declare function redactConfigFields(config: Record<string, unknown>, encryptedPaths: string[]): Record<string, unknown>;
//# sourceMappingURL=encryption.d.ts.map