import { Signer } from '@cfxdevkit/cdk';
import { AesGcmKey, decryptAesGcm, encryptAesGcm, fromBase64Url, toBase64Url, toHex } from '../../crypto/index.js';
import { KeystorePutInput, SecretRef, StoredSecret } from '../index.js';
declare const FORMAT_VERSION: "cfx-v1";
export interface Envelope {
    version: typeof FORMAT_VERSION;
    kdf: {
        name: 'argon2id';
        salt: string;
        memKiB: number;
        iterations: number;
        parallelism: number;
    };
    secrets: Record<string, EncryptedSecret>;
}
export interface EncryptedSecret {
    kind: StoredSecret['kind'];
    createdAt: number;
    meta?: Record<string, string>;
    iv: string;
    ct: string;
    tag: string;
}
export declare function refKey(ref: SecretRef): string;
export declare function checkAborted(signal?: AbortSignal): void;
export declare function readEnvelope(path: string): Promise<Envelope>;
export declare function writeEnvelope(path: string, env: Envelope): Promise<void>;
export interface KdfParams {
    /** Memory cost in KiB. Production default: 64 MiB. Use a small value (≥ 8) in tests. */
    memKiB?: number;
    /** Time cost (iterations). Production default: 3. */
    iterations?: number;
    /** Parallelism / lanes. Default: 1. */
    parallelism?: number;
}
export declare function emptyEnvelope(salt: Uint8Array, kdf?: KdfParams): Envelope;
export declare function deriveKekFromEnvelope(env: Envelope, passphrase: string): Promise<AesGcmKey>;
export declare function aadFor(ref: SecretRef): Uint8Array;
export declare function plaintextFor(input: KeystorePutInput): Uint8Array;
export declare function signerFromSecret(rec: EncryptedSecret, secret: string, derivationPath?: string): Signer;
export declare function validatePutInput(input: KeystorePutInput): void;
export declare function initFileKeystore(input: {
    path: string;
    passphrase: string;
    kdf?: KdfParams;
}): Promise<void>;
export declare function changeFilePassphrase(input: {
    path: string;
    oldPassphrase: string;
    newPassphrase: string;
}): Promise<void>;
export { decryptAesGcm, encryptAesGcm, fromBase64Url, toBase64Url, toHex };
//# sourceMappingURL=internals.d.ts.map