/**
 * Encryption utilities for sensitive data at rest
 *
 * Uses AES-256-GCM for authenticated encryption with PBKDF2 key derivation.
 *
 * Security notes:
 * - Key derivation uses PBKDF2-SHA512 with 100,000+ iterations (OWASP recommended)
 * - NEVER falls back to JWT secret (would cause data loss on rotation)
 * - Supports versioned key derivation for future algorithm changes
 * - KDF v1 (SHA-256) is DEPRECATED - migrate all data to v2 before deprecation date
 *
 * KDF v1 DEPRECATION TIMELINE:
 * - Warning phase: Now until 2025-06-01
 * - Error phase: After 2025-06-01, v1 decryption throws an error
 * - Run `vorion migrate encryption` to migrate all v1 data to v2
 */
/**
 * SECURITY: No hardcoded fallback credentials
 *
 * Encryption keys MUST be explicitly configured via environment variables:
 * - VORION_ENCRYPTION_KEY: At least 32 characters, cryptographically random
 * - VORION_ENCRYPTION_SALT: At least 16 characters, cryptographically random
 *
 * Generate secure keys using: vorion secrets generate --type encryption
 *
 * This applies to ALL environments including development.
 * See docs/security/ENCRYPTION_SETUP.md for configuration instructions.
 */
/**
 * Key derivation function versions:
 * - v1: SHA-256 (legacy, insecure - for migration only)
 * - v2: PBKDF2-SHA512 (current, secure)
 */
export type KdfVersion = 1 | 2;
/**
 * Encrypted data envelope containing all components needed for decryption
 */
export interface EncryptedEnvelope {
    /** Encrypted data as base64 */
    ciphertext: string;
    /** Initialization vector as base64 */
    iv: string;
    /** Authentication tag as base64 */
    authTag: string;
    /** Envelope version for future algorithm changes */
    version: 1;
    /**
     * Key derivation version used to encrypt this data
     * - kdfVersion 1: SHA-256 (legacy)
     * - kdfVersion 2: PBKDF2-SHA512 (current)
     * If absent, assumes v1 for backward compatibility
     */
    kdfVersion?: KdfVersion;
}
/**
 * Marker interface to identify encrypted fields in JSON
 */
export interface EncryptedField {
    __encrypted: true;
    envelope: EncryptedEnvelope;
}
/**
 * Encrypt a value using AES-256-GCM with PBKDF2-derived key
 */
export declare function encrypt(plaintext: string): EncryptedEnvelope;
/**
 * Decrypt a value using AES-256-GCM
 *
 * Automatically detects and uses the correct KDF version from the envelope.
 * This ensures backward compatibility with data encrypted using the legacy SHA-256 method.
 */
export declare function decrypt(envelope: EncryptedEnvelope): string;
/**
 * Encrypt a JSON object, returning an encrypted field marker
 */
export declare function encryptObject(data: Record<string, unknown>): EncryptedField;
/**
 * Decrypt an encrypted field marker back to a JSON object.
 *
 * Uses safe JSON parsing with prototype pollution protection
 * and schema validation to ensure security.
 */
export declare function decryptObject(field: EncryptedField): Record<string, unknown>;
/**
 * Check if a value is an encrypted field
 */
export declare function isEncryptedField(value: unknown): value is EncryptedField;
/**
 * Compute SHA-256 hash for tamper detection
 */
export declare function computeHash(data: string): string;
/**
 * Compute chained hash (includes previous hash for chain integrity)
 */
export declare function computeChainedHash(data: string, previousHash: string): string;
/**
 * Check if an envelope needs migration to the current KDF version
 *
 * @param envelope - The encrypted envelope to check
 * @returns true if the envelope uses an older KDF version than current config
 */
export declare function needsMigration(envelope: EncryptedEnvelope): boolean;
/**
 * Migrate an encrypted envelope to the current KDF version
 *
 * This decrypts the data using its original KDF and re-encrypts with the current KDF.
 * Use this during a migration window to upgrade legacy encrypted data.
 *
 * @param envelope - The encrypted envelope to migrate
 * @returns New envelope encrypted with current KDF version
 * @throws EncryptionError if decryption or re-encryption fails
 */
export declare function migrateEnvelope(envelope: EncryptedEnvelope): EncryptedEnvelope;
/**
 * Migrate an encrypted field to the current KDF version
 *
 * @param field - The encrypted field to migrate
 * @returns New field with envelope encrypted using current KDF version
 */
export declare function migrateEncryptedField(field: EncryptedField): EncryptedField;
/**
 * Get the KDF version used in an envelope
 *
 * @param envelope - The envelope to check
 * @returns The KDF version (1 for legacy, 2 for PBKDF2)
 */
export declare function getEnvelopeKdfVersion(envelope: EncryptedEnvelope): KdfVersion;
/**
 * Migration result for a single item
 */
export interface MigrationResult {
    success: boolean;
    migrated: boolean;
    originalKdfVersion: KdfVersion;
    newKdfVersion: KdfVersion;
    error?: string;
}
/**
 * Batch migration result
 */
export interface BatchMigrationResult {
    total: number;
    migrated: number;
    skipped: number;
    failed: number;
    errors: Array<{
        index: number;
        error: string;
    }>;
}
/**
 * Migrate encrypted data to the latest KDF version
 *
 * This is the main migration function that handles any encrypted data format.
 * It automatically detects the format (envelope or field) and migrates accordingly.
 *
 * @param encryptedData - Encrypted envelope or field to migrate
 * @returns Migrated data in the same format as input
 * @throws EncryptionError if migration fails
 *
 * @example
 * ```typescript
 * // Migrate an envelope
 * const migratedEnvelope = migrateToLatestKdf(legacyEnvelope);
 *
 * // Migrate an encrypted field
 * const migratedField = migrateToLatestKdf(legacyField);
 * ```
 */
export declare function migrateToLatestKdf(encryptedData: EncryptedEnvelope | EncryptedField): EncryptedEnvelope | EncryptedField;
/**
 * Get the v1 KDF deprecation status and information
 *
 * Use this to check deprecation status and show appropriate warnings to users.
 *
 * @returns Deprecation status information
 */
export declare function getKdfDeprecationStatus(): {
    isDeprecated: boolean;
    deprecationDate: string;
    daysUntilDeprecation: number;
    v1DecryptionCount: number;
};
/**
 * Check startup for v1 encrypted data and log warnings
 *
 * Call this during application startup to warn about legacy encrypted data
 * that needs migration.
 *
 * @param envelopes - Array of encrypted envelopes to check
 * @returns Object with counts of v1 and v2 envelopes
 */
export declare function checkStartupEncryption(envelopes: EncryptedEnvelope[]): {
    v1Count: number;
    v2Count: number;
    needsMigration: boolean;
};
/**
 * Migrate a batch of envelopes with progress tracking
 *
 * @param envelopes - Array of envelopes to migrate
 * @param onProgress - Optional callback for progress updates
 * @returns Batch migration result with statistics
 */
export declare function migrateEnvelopeBatch(envelopes: EncryptedEnvelope[], onProgress?: (current: number, total: number) => void): {
    results: EncryptedEnvelope[];
    stats: BatchMigrationResult;
};
import type { Config } from './config.js';
/**
 * Create an encryptIfEnabled function with injected configuration.
 *
 * This factory function removes the service locator anti-pattern by
 * accepting configuration via parameter rather than calling getConfig().
 *
 * NOTE: This version does not include tracing to avoid circular dependencies.
 * Use the traceEncryptSync wrapper from intent/tracing.js when tracing is needed.
 *
 * @param config - Application configuration (for encryption settings)
 * @returns Function that encrypts data if encryption is enabled in config
 *
 * @example
 * // With dependency injection
 * const encryptIfEnabled = createEncryptIfEnabled(config);
 * const encrypted = encryptIfEnabled(sensitiveData);
 *
 * @example
 * // For testing
 * const mockConfig = { intent: { encryptContext: false } } as Config;
 * const encryptIfEnabled = createEncryptIfEnabled(mockConfig);
 */
export declare function createEncryptIfEnabled(config: Config): (data: Record<string, unknown>) => unknown;
//# sourceMappingURL=encryption.d.ts.map