type SecretInput = string | Buffer;
/**
 * Derives a 256-bit key from a password and salt using PBKDF2-SHA512.
 * Used only for decrypting legacy v1: data.
 */
export declare function deriveKey(password: SecretInput, salt: Buffer): Buffer;
/**
 * Encrypts plaintext using AES-256-GCM with an Argon2id-derived key.
 * Output format: `v2:<salt_hex><iv_hex><authTag_hex><ciphertext_hex>`
 */
export declare function encrypt(text: string, password: SecretInput): Promise<string>;
/**
 * Decrypts data produced by `encrypt`.
 * Handles v2: (Argon2id), v1: (PBKDF2), and legacy unprefixed (PBKDF2) data.
 */
export declare function decrypt(encryptedData: string, password: SecretInput): Promise<string>;
export declare function generateId(): string;
export declare function generateSessionToken(): string;
/**
 * Masks a secret value for display, revealing only the first and last `showLength` characters.
 * Short values are fully masked.
 */
export declare function maskValue(value: string, showLength?: number): string;
export declare function validatePassword(password: string, config: {
    min_length?: number;
    require_complexity?: boolean;
    allow_numeric_only?: boolean;
    allow_single_char?: boolean;
}): {
    valid: boolean;
    error?: string;
    warning?: string;
};
/**
 * Hashes a per-variable password using Argon2id for storage.
 * The returned string is the standard Argon2 encoded hash (includes salt, params).
 */
export declare function hashVariablePassword(password: string): Promise<string>;
/**
 * Verifies a per-variable password against a stored Argon2id hash.
 */
export declare function verifyVariablePassword(password: string, hash: string): Promise<boolean>;
/**
 * Encrypts a variable value with a per-variable password.
 * Uses the same v2 AES-256-GCM + Argon2id scheme as vault encryption.
 */
export declare function encryptVariableValue(value: string, variablePassword: string): Promise<string>;
/**
 * Decrypts a variable value with a per-variable password.
 */
export declare function decryptVariableValue(encryptedValue: string, variablePassword: string): Promise<string>;
/**
 * Scrubs known secret values and common secret patterns from command output.
 * Applied to stdout/stderr before returning envcp_run results to AI agents.
 *
 * @param output - Raw command output string
 * @param secrets - Plaintext values of injected variables (replaced with [REDACTED])
 * @param extraPatterns - Additional regex pattern strings from config
 */
export declare function scrubOutput(output: string, secrets: string[], extraPatterns?: string[]): string;
export declare function quickHash(input: string): string;
export declare function generateRecoveryKey(): string;
export declare function createRecoveryData(password: string, recoveryKey: string): Promise<string>;
export declare function recoverPassword(recoveryData: string, recoveryKey: string): Promise<string>;
export {};
//# sourceMappingURL=crypto.d.ts.map