export interface EncryptedCredential {
    algorithm: "aes-256-gcm";
    version: number;
    /** Random 16-byte IV, base64-encoded. Fresh per encryption call. */
    iv: string;
    /** AES-256-GCM ciphertext, base64-encoded. */
    encryptedData: string;
    /** GCM authentication tag, base64-encoded. Prevents tampering. */
    authTag: string;
    /**
     * Per-blob random 16-byte salt for scrypt-based key derivation.
     * Present from v3 onwards (CRED-003 fix). v1/v2 blobs derive the key
     * deterministically from host material with no per-file salt — readable
     * for back-compat but never written.
     */
    salt?: string;
}
export declare function getMachineSecret(): string;
/** Test hook — clears the cache so tests can probe each resolution path. */
export declare function _resetMachineSecretCacheForTests(): void;
export declare class CredentialEncryption {
    private static readonly APP_SALT;
    /** Always write the current version. Older versions remain readable. */
    static readonly CURRENT_VERSION = 3;
    /** scrypt cost params — N=2^14 keeps key derivation under ~50ms on 2020+
     *  hardware while raising the per-blob attack cost from a single SHA-256
     *  to ~16k rounds + 16MB memory. */
    private static readonly SCRYPT_N;
    private static readonly SCRYPT_r;
    private static readonly SCRYPT_p;
    private static readonly SCRYPT_MAXMEM;
    /**
     * Derive a 32-byte AES key for the given blob version.
     * v1: sha256(hostname || salt || platform)                — legacy, portable across clones
     * v2: sha256(machine-id || hostname || salt || platform)  — per-system, blocks clone re-decrypt
     * v3: scrypt(machine-id || hostname || platform, perBlobSalt, N=16384, r=8, p=1, 32 bytes)
     *     — per-blob salt + memory-hard KDF. Resists pre-computation and
     *       cheap brute-force against the (low-entropy) host material.
     *     — Closes CRED-003 from the 2026-05-28 audit. v1/v2 stay readable
     *       so existing blobs continue to decrypt; the next `encrypt()` call
     *       upgrades them to v3.
     */
    private static deriveKey;
    static encrypt(plaintext: string): EncryptedCredential;
    static decrypt(encrypted: EncryptedCredential): string;
    static isValidEncrypted(obj: unknown): obj is EncryptedCredential;
    /** Is this blob written with an older format that should be re-encrypted? */
    static needsReencrypt(encrypted: EncryptedCredential): boolean;
}
//# sourceMappingURL=credential-encryption.d.ts.map