/**
 * Passphrase-wrapped bundle format for `studiograph admin backup` /
 * `restore`.
 *
 * Wire format (single binary file):
 *   magic     [4]  ASCII "SG1\0"
 *   version   [1]  0x01
 *   salt      [16] random per encrypt; fed to scrypt
 *   nonce     [24] random per encrypt; fed to xchacha20poly1305
 *   ciphertext (variable) — AEAD output (ciphertext + 16-byte tag)
 *
 * The AAD is the magic+version+salt+nonce header bytes themselves, so
 * tampering with any header field invalidates the tag.
 *
 * Crypto choices:
 *   - scrypt(passphrase, salt, N=2^17, r=8, p=1, keylen=32) → 32B key.
 *     N=131072 is the OWASP 2023 recommendation for password-hashing.
 *     Tunable upwards in the future via the `version` byte.
 *   - xchacha20poly1305(key, nonce, aad) → ciphertext + 16B tag.
 *     Same primitive used by the encrypted secrets store
 *     ([src/core/secrets/encryption.ts]), so we don't fan out crypto
 *     dependencies for a single new feature.
 *
 * What this module does NOT do: stream encryption. The whole bundle is
 * loaded into memory for encrypt/decrypt. Workspaces are typically
 * 1-100 MB; if a workspace ever grows past ~500MB this should be
 * upgraded to a streaming AEAD (libsodium secretstream / age-style
 * chunked AEAD). For now the simpler one-shot design is correct.
 */
export declare function sealBundle(plaintext: Buffer, passphrase: string): Buffer;
export declare function openBundle(bundle: Buffer, passphrase: string): Buffer;
export declare const BUNDLE_FORMAT: {
    readonly MAGIC: Buffer<ArrayBuffer>;
    readonly VERSION_V1: 1;
    readonly SALT_LEN: 16;
    readonly NONCE_LEN: 24;
    readonly KEY_LEN: 32;
    readonly HEADER_LEN: number;
};
