/**
 * Key derivation function versions:
 * - v1: SHA-256 (legacy, insecure - for migration only)
 * - v2: PBKDF2-SHA512 (current, secure)
 */
export type KdfVersion = 1 | 2;
/**
 * Encrypted data envelope containing all components needed for decryption
 */
export interface EncryptedEnvelope {
    /** Encrypted data as base64 */
    ciphertext: string;
    /** Initialization vector as base64 */
    iv: string;
    /** Authentication tag as base64 */
    authTag: string;
    /** Envelope version for future algorithm changes */
    version: 1;
    /**
     * Key derivation version used to encrypt this data
     * - kdfVersion 1: SHA-256 (legacy)
     * - kdfVersion 2: PBKDF2-SHA512 (current)
     * If absent, assumes v1 for backward compatibility
     */
    kdfVersion?: KdfVersion;
}
/**
 * Marker interface to identify encrypted fields in JSON
 */
export interface EncryptedField {
    __encrypted: true;
    envelope: EncryptedEnvelope;
}
/**
 * Encrypt a value using AES-256-GCM with PBKDF2-derived key
 */
export declare function encrypt(plaintext: string): EncryptedEnvelope;
/**
 * Decrypt a value using AES-256-GCM
 *
 * Automatically detects and uses the correct KDF version from the envelope.
 * This ensures backward compatibility with data encrypted using the legacy SHA-256 method.
 */
export declare function decrypt(envelope: EncryptedEnvelope): string;
/**
 * Encrypt a JSON object, returning an encrypted field marker
 */
export declare function encryptObject(data: Record<string, unknown>): EncryptedField;
/**
 * Decrypt an encrypted field marker back to a JSON object
 */
export declare function decryptObject(field: EncryptedField): Record<string, unknown>;
/**
 * Check if a value is an encrypted field
 */
export declare function isEncryptedField(value: unknown): value is EncryptedField;
/**
 * Compute SHA-256 hash for tamper detection
 */
export declare function computeHash(data: string): string;
/**
 * Compute chained hash (includes previous hash for chain integrity)
 */
export declare function computeChainedHash(data: string, previousHash: string): string;
/**
 * Check if an envelope needs migration to the current KDF version
 *
 * @param envelope - The encrypted envelope to check
 * @returns true if the envelope uses an older KDF version than current config
 */
export declare function needsMigration(envelope: EncryptedEnvelope): boolean;
/**
 * Migrate an encrypted envelope to the current KDF version
 *
 * This decrypts the data using its original KDF and re-encrypts with the current KDF.
 * Use this during a migration window to upgrade legacy encrypted data.
 *
 * @param envelope - The encrypted envelope to migrate
 * @returns New envelope encrypted with current KDF version
 * @throws EncryptionError if decryption or re-encryption fails
 */
export declare function migrateEnvelope(envelope: EncryptedEnvelope): EncryptedEnvelope;
/**
 * Migrate an encrypted field to the current KDF version
 *
 * @param field - The encrypted field to migrate
 * @returns New field with envelope encrypted using current KDF version
 */
export declare function migrateEncryptedField(field: EncryptedField): EncryptedField;
/**
 * Get the KDF version used in an envelope
 *
 * @param envelope - The envelope to check
 * @returns The KDF version (1 for legacy, 2 for PBKDF2)
 */
export declare function getEnvelopeKdfVersion(envelope: EncryptedEnvelope): KdfVersion;
import type { Config } from './config.js';
/**
 * Create an encryptIfEnabled function with injected configuration.
 *
 * This factory function removes the service locator anti-pattern by
 * accepting configuration via parameter rather than calling getConfig().
 *
 * NOTE: This version does not include tracing to avoid circular dependencies.
 * Use the traceEncryptSync wrapper from intent/tracing.js when tracing is needed.
 *
 * @param config - Application configuration (for encryption settings)
 * @returns Function that encrypts data if encryption is enabled in config
 *
 * @example
 * // With dependency injection
 * const encryptIfEnabled = createEncryptIfEnabled(config);
 * const encrypted = encryptIfEnabled(sensitiveData);
 *
 * @example
 * // For testing
 * const mockConfig = { intent: { encryptContext: false } } as Config;
 * const encryptIfEnabled = createEncryptIfEnabled(mockConfig);
 */
export declare function createEncryptIfEnabled(config: Config): (data: Record<string, unknown>) => unknown;
//# sourceMappingURL=encryption.d.ts.map