/**
 * Credential encryption — AES-256-GCM with machine-bound key derivation.
 *
 * API keys (`sk_live_*`) are encrypted at rest in SQLite using AES-256-GCM.
 * The encryption key is derived per-project from a machine-specific secret:
 *
 *   machine-key (32 random bytes at ~/.local/share/cleo/machine-key)
 *   + project path
 *   = HMAC-SHA256(machine-key, project-path) → per-project AES key
 *
 * This means credentials are bound to BOTH the machine AND the project.
 * Moving `.cleo/tasks.db` to another machine renders stored keys unreadable.
 *
 * @see docs/specs/SIGNALDOCK-UNIFIED-AGENT-REGISTRY.md Section 3.6
 * @module crypto/credentials
 */
/**
 * Encrypt a plaintext string using AES-256-GCM with a per-project key.
 *
 * Output format: base64(version + iv + ciphertext + authTag)
 *   - version: 1 byte (0x01 = AES-256-GCM)
 *   - iv: 12 bytes
 *   - ciphertext: variable length
 *   - authTag: 16 bytes
 *
 * @param plaintext - The string to encrypt (e.g. an API key).
 * @param projectPath - Absolute path to the project directory (used for key derivation).
 * @returns Base64-encoded ciphertext.
 */
export declare function encrypt(plaintext: string, projectPath: string): Promise<string>;
/**
 * Decrypt a base64-encoded ciphertext using AES-256-GCM with a per-project key.
 *
 * @param ciphertext - Base64-encoded string from `encrypt()`.
 * @param projectPath - Absolute path to the project directory (must match the one used for encryption).
 * @returns The original plaintext string.
 * @throws If decryption fails (wrong key, corrupted data, or machine key mismatch).
 */
export declare function decrypt(ciphertext: string, projectPath: string): Promise<string>;
/**
 * Encrypt a plaintext string using AES-256-GCM with a global, machine-bound key.
 *
 * Output format is byte-identical to {@link encrypt}:
 * base64(version + iv + ciphertext + authTag)
 *   - version: 1 byte (0x01 = AES-256-GCM)
 *   - iv: 12 bytes
 *   - ciphertext: variable length
 *   - authTag: 16 bytes
 *
 * The encryption key is derived via {@link deriveGlobalKey} (machine-key +
 * global-salt + `id`), so the resulting ciphertext decrypts from any project
 * on the same machine — unlike the project-bound {@link encrypt}.
 *
 * @param plaintext - The string to encrypt (e.g. an LLM API key).
 * @param id - The stable identity used for key derivation (e.g. an agentId).
 * @returns Base64-encoded ciphertext.
 *
 * @see decryptGlobal — the inverse operation.
 * @task T11710
 */
export declare function encryptGlobal(plaintext: string, id: string): Promise<string>;
/**
 * Decrypt a base64-encoded ciphertext produced by {@link encryptGlobal} using
 * the global, machine-bound key derived from `id`.
 *
 * @param ciphertext - Base64-encoded string from {@link encryptGlobal}.
 * @param id - The identity used at encryption time. A mismatched `id` derives a
 *   different key and fails the GCM auth tag (throws).
 * @returns The original plaintext string.
 * @throws If decryption fails (wrong id, corrupted data, or machine-key/
 *   global-salt mismatch).
 *
 * @see encryptGlobal — the inverse operation.
 * @task T11710
 */
export declare function decryptGlobal(ciphertext: string, id: string): Promise<string>;
//# sourceMappingURL=credentials.d.ts.map