/**
 * EncryptedEnvelope
 *
 * Framework-compatible encrypted payload envelope (PHP-style envelope).
 *
 * Format: base64(JSON({ iv, value, mac, tag }))
 * - iv: base64
 * - value: base64 ciphertext
 * - mac: hex string (AES-CBC envelopes)
 * - tag: base64 auth tag (AES-GCM envelopes)
 */
export type EncryptedEnvelopeCipher = 'aes-256-cbc' | 'aes-256-gcm';
export type EncryptedEnvelopeCipherInput = EncryptedEnvelopeCipher | 'AES-256-CBC' | 'AES-256-GCM';
export type EncryptedEnvelopePayload = {
    iv: string;
    value: string;
    mac?: string;
    tag?: string;
};
export type EncryptedEnvelopeSerializer<T> = {
    serialize: (value: T) => string;
    deserialize: (value: string) => T;
};
export type EncryptedEnvelopeKeyring = {
    primaryKey: Uint8Array;
    previousKeys: Uint8Array[];
};
export type EncryptedEnvelopeEnv = {
    APP_KEY?: string;
    APP_PREVIOUS_KEYS?: string;
    ENCRYPTION_CIPHER?: string;
};
export declare const EncryptedEnvelope: Readonly<{
    normalizeCipher: (cipher: EncryptedEnvelopeCipherInput) => EncryptedEnvelopeCipher;
    /**
     * Build a keyring from environment variables.
     * - Uses APP_KEY
     * - Supports APP_PREVIOUS_KEYS (comma-separated or JSON array)
     */
    keyringFromEnv(env?: EncryptedEnvelopeEnv): EncryptedEnvelopeKeyring;
    /**
     * Encrypt a UTF-8 string and return a framework-compatible base64(JSON) envelope.
     */
    encryptString(plaintext: string, options: {
        cipher: EncryptedEnvelopeCipherInput;
        key: string;
    }): string;
    /**
     * Decrypt a framework-compatible base64(JSON) envelope to a UTF-8 string.
     * Tries the primary key first, then previous keys.
     */
    decryptString(encrypted: string, options: {
        cipher: EncryptedEnvelopeCipherInput;
        key: string;
        previousKeys?: string[];
    }): string;
    /**
     * Encrypt arbitrary values using a caller-provided serializer.
     * This supports encrypted payloads for frameworks that store serialized values.
     */
    encrypt<T>(value: T, options: {
        cipher: EncryptedEnvelopeCipherInput;
        key: string;
        serializer: EncryptedEnvelopeSerializer<T>;
    }): string;
    /**
     * Decrypt into an arbitrary value using a caller-provided serializer.
     */
    decrypt<T>(encrypted: string, options: {
        cipher: EncryptedEnvelopeCipherInput;
        key: string;
        previousKeys?: string[];
        serializer: EncryptedEnvelopeSerializer<T>;
    }): T;
}>;
export default EncryptedEnvelope;
//# sourceMappingURL=EncryptedEnvelope.d.ts.map