/**
 * Encryption Module (SEC-03 Fix)
 *
 * Encrypts sensitive PII data before storing in localStorage
 * Uses Web Crypto API for AES-GCM encryption
 *
 * SECURITY NOTE: This protects against casual localStorage reads,
 * but determined XSS attacks can still access the encryption key in memory.
 * Primary defense is preventing XSS (see container.ts sandboxing).
 */
export declare class DataEncryption {
    private key;
    private salt;
    /**
     * Initialize encryption with workspace-specific key
     *
     * FIXED (SEC-03): Now uses random per-device salt stored in localStorage
     *
     * @param workspaceId - Used to derive encryption key
     * @param deviceId - Device-specific identifier for key derivation
     */
    initialize(workspaceId: string, deviceId: string): Promise<void>;
    /**
     * Encrypt sensitive data
     *
     * FIXED (SEC-03): No longer silently falls back to unencrypted storage
     *
     * @param data - Plain text or object to encrypt
     * @returns Base64-encoded encrypted data with IV
     * @throws Error if encryption is not available or fails
     */
    encrypt(data: any): Promise<string>;
    /**
     * Decrypt sensitive data
     *
     * FIXED (SEC-03): Still allows backwards compatibility for migration,
     * but logs warnings when unencrypted data is detected
     *
     * @param encryptedData - Base64-encoded encrypted data
     * @returns Decrypted data (parsed as JSON if possible)
     */
    decrypt(encryptedData: string): Promise<any>;
    /**
     * Check if encryption is available and initialized
     */
    isAvailable(): boolean;
    /**
     * Helper: Convert ArrayBuffer to Base64
     */
    private arrayBufferToBase64;
    /**
     * Helper: Convert Base64 to ArrayBuffer
     */
    private base64ToArrayBuffer;
    /**
     * Destroy encryption keys (called on SDK destroy)
     *
     * FIXED (SEC-03): Also clears salt reference
     */
    destroy(): void;
}
export declare const dataEncryption: DataEncryption;
//# sourceMappingURL=encryption.d.ts.map