import { ShareEncryptionService, ShareEncryptionResult, DecryptedSharePayload } from '../../domain/services/share-encryption-service';
/** Dev/demo encryption service. Encrypts shares with AES-GCM but returns the raw DEK as
 * `encryptedKey` instead of RSA-wrapping it. This allows the fake merge repo to return the
 * DEK directly without needing an HSM or transit RSA private key. */
export declare class FakeShareEncryptionService implements ShareEncryptionService {
    private static readonly BASE64_CHUNK_SIZE;
    encryptShares(shares: Array<{
        id: string;
        data?: string;
    }>, existingSymmetricKeyBase64?: string, masterKey?: string): Promise<ShareEncryptionResult>;
    unwrapDEKWithMasterKey(masterKeyWrappedDEKBase64: string, _masterKeyHex: string): Promise<string>;
    decryptShares(shares: Array<{
        id: string;
        encryptedData: string;
    }>, dekBase64: string): Promise<DecryptedSharePayload[]>;
    private generateKey;
    private importKey;
    private encrypt;
    private decrypt;
    private bytesToBase64;
    private base64ToBytes;
}
