export type VaultKeySource = "env" | "keychain" | "keyfile";
export interface ResolvedVaultKey {
    readonly key: Buffer;
    readonly source: VaultKeySource;
}
export type KeychainAccess = () => Buffer | undefined;
export interface MemoryContentCipher {
    readonly sealString: (plaintext: string) => string;
    readonly openString: (envelope: string) => string;
    readonly sealBytes: (buf: Buffer) => Buffer;
    readonly openBytes: (envelope: Buffer) => Buffer;
    readonly isSealed: (value: string) => boolean;
}
export declare function resolveVaultKey(env: Readonly<Record<string, string | undefined>>, memoryDir: string, keychainAccess?: KeychainAccess): ResolvedVaultKey;
export declare const NO_KEYCHAIN: KeychainAccess;
export declare function createMemoryContentCipher(key: Buffer): MemoryContentCipher;
//# sourceMappingURL=cipher.d.ts.map