/**
 * Session Encryption for secure storage of chat sessions
 *
 * Uses AES-256-GCM for authenticated encryption:
 * - Encrypts session content before storage
 * - Protects sensitive conversation data
 * - Key derived from user password or machine-specific key
 */
export interface EncryptedData {
    /** Encrypted ciphertext (base64) */
    ciphertext: string;
    /** Initialization vector (base64) */
    iv: string;
    /** GCM authentication tag (base64) */
    authTag: string;
    /** Salt for key derivation (base64) */
    salt: string;
    /** Version for forward compatibility */
    version: number;
}
export interface EncryptionConfig {
    /** Path to store the encryption key */
    keyPath?: string;
    /** Use password-based key derivation */
    usePassword?: boolean;
    /** Enable encryption (can be disabled for performance) */
    enabled?: boolean;
}
/**
 * Session encryption manager
 */
export declare class SessionEncryption {
    private config;
    private key;
    private initialized;
    constructor(config?: EncryptionConfig);
    /**
     * Initialize encryption with machine-generated key
     */
    initialize(): Promise<void>;
    /**
     * Initialize with password-based key
     */
    initializeWithPassword(password: string, salt?: string): Promise<string>;
    /**
     * Encrypt data
     */
    encrypt(data: string): EncryptedData;
    /**
     * Decrypt data
     */
    decrypt(encrypted: EncryptedData): string;
    /**
     * Encrypt JSON object
     */
    encryptObject<T>(obj: T): EncryptedData;
    /**
     * Decrypt to JSON object
     */
    decryptObject<T>(encrypted: EncryptedData): T;
    /**
     * Check if data is encrypted
     */
    isEncrypted(data: EncryptedData): boolean;
    /**
     * Derive key from password using PBKDF2
     */
    private deriveKeyFromPassword;
    /**
     * Derive a key from machine-specific data
     * (Used as fallback when key file can't be created)
     */
    private deriveMachineKey;
    /**
     * Rotate encryption key
     * Re-encrypts all data with a new key
     */
    rotateKey(): Promise<{
        oldKey: string;
        newKey: string;
    }>;
    /**
     * Check if encryption is enabled and initialized
     */
    isReady(): boolean;
    /**
     * Get encryption status
     */
    getStatus(): {
        enabled: boolean;
        initialized: boolean;
        algorithm: string;
        keyLength: number;
    };
    /**
     * Clear encryption key from memory
     */
    dispose(): void;
}
/**
 * Get or create the session encryption instance
 */
export declare function getSessionEncryption(): SessionEncryption;
/**
 * Initialize session encryption
 */
export declare function initializeEncryption(config?: EncryptionConfig): Promise<SessionEncryption>;
/**
 * Reset session encryption
 */
export declare function resetSessionEncryption(): void;
export default SessionEncryption;
