/**
 * Shared AES-256-GCM encryption for secret values at rest.
 *
 * Used by the framework secrets vault, per-user/per-org credentials
 * (`resolveCredential` / `saveCredential`, stored in `settings`), and other
 * column-level encrypted values. The `app_secrets` storage layer uses the
 * shared-key variant below because workspace-scoped vault rows are readable by
 * sibling apps in the same workspace. When a deployment has not been given
 * shared key material yet, that variant falls back to the app-scoped key so
 * existing single-app deployments can keep reading and writing secrets while
 * they migrate to the shared key.
 *
 * The default encryption key is derived from
 * `<APP_NAME>_SECRETS_ENCRYPTION_KEY` when set, then `SECRETS_ENCRYPTION_KEY`,
 * then `BETTER_AUTH_SECRET`. The app-scoped key lets a local multi-app
 * workspace read one app's encrypted production data without replacing the
 * shared local auth secret. Hosted workspace deploys (`AGENT_NATIVE_WORKSPACE`)
 * typically set none of those literal env vars per app; in that case the
 * shared-key variant falls back further to material derived from the
 * workspace-wide `A2A_SECRET` (see `getWorkspaceA2ADerivedSecret`), so sibling
 * apps in the same workspace still land on the same shared key without any
 * extra configuration. In production we refuse to start without configured
 * key material — a CWD-derived fallback would be effectively static (e.g.
 * `/var/task` on Lambda), so anyone with read access to the DB could decrypt
 * every secret.
 *
 * Encrypted values are tagged `v1:<iv-hex>:<ct-hex>:<tag-hex>`. The `v1:` prefix
 * lets readers distinguish ciphertext from legacy plaintext during migration.
 */
/**
 * Derive the key used by generic encrypted values such as credentials and
 * OAuth tokens. App-specific key material is allowed for these app-local
 * values.
 */
export declare function getSecretEncryptionKey(): Buffer;
/**
 * Derive the preferred workspace-shared key used by `app_secrets` rows.
 * Unlike generic column-level encryption, workspace vault data should decrypt
 * in sibling apps, so `SECRETS_ENCRYPTION_KEY` / `BETTER_AUTH_SECRET` take
 * precedence. Hosted workspace deploys (`AGENT_NATIVE_WORKSPACE`) that set
 * neither literal var still get stable shared material derived from the
 * workspace-wide `A2A_SECRET` before falling further back. The app-scoped key
 * remains a compatibility fallback for deployments that have not configured
 * shared material yet; once the shared key is configured, writes use it and
 * reads still fall back to old rows.
 */
export declare function getSharedSecretEncryptionKey(): Buffer;
/** Whether this deployment has stable workspace-shared key material. */
export declare function hasSharedSecretEncryptionKeyMaterial(): boolean;
/** Encrypt a plain-text value with the generic app-local key. */
export declare function encryptSecretValue(plaintext: string): string;
/** Decrypt a value produced by `encryptSecretValue`. Throws on tampering. */
export declare function decryptSecretValue(encrypted: string): string;
/** Encrypt a workspace-shared `app_secrets` value. */
export declare function encryptSharedSecretValue(plaintext: string): string;
/** Decrypt a workspace-shared `app_secrets` value. */
export declare function decryptSharedSecretValue(encrypted: string): string;
export declare function isEncryptedSecretValue(value: unknown): value is string;
//# sourceMappingURL=crypto.d.ts.map