/**
 * Column-level encryption for SQLite DB fields
 *
 * Uses AES-256-GCM with per-value random IV.
 * Storage format: iv:authTag:ciphertext (all hex-encoded)
 *
 * Design decisions (see plan Section 7 - blockchain compatibility):
 * - Only content/payload columns are encrypted (never IDs, timestamps, hashes, signatures)
 * - Hash-chain integrity uses ciphertext: event_hash = hash(ciphertext || metadata)
 * - Encryption/decryption happens in the repository layer only
 */
/**
 * Encrypt a string value for storage in a DB column.
 *
 * @param plaintext - The value to encrypt (typically JSON-stringified)
 * @param key - 32-byte AES-256 key (Data Key from key_derivation)
 * @returns Encrypted string in format iv:authTag:ciphertext (hex)
 */
export declare function encryptColumn(plaintext: string, key: Uint8Array): string;
/**
 * Decrypt a column value from the iv:authTag:ciphertext format.
 *
 * @param encrypted - Encrypted string in format iv:authTag:ciphertext (hex)
 * @param key - 32-byte AES-256 key (same Data Key used for encryption)
 * @returns Decrypted plaintext string
 * @throws Error if decryption fails (wrong key, tampered data, bad format)
 */
export declare function decryptColumn(encrypted: string, key: Uint8Array): string;
/**
 * Check whether a string value looks like an encrypted column (iv:authTag:ciphertext hex format).
 *
 * Useful for backward compatibility: detect whether a value is plaintext or already encrypted.
 *
 * @param value - The string to check
 * @returns true if the value matches the encrypted column format
 */
export declare function isEncryptedColumn(value: string): boolean;
//# sourceMappingURL=column_encryption.d.ts.map