import { Buffer } from "node:buffer";
export declare const ENCRYPTED_PAYLOAD_FIELD = "encryptedPayload";
export declare const PATHWAY_ENCRYPTED_METADATA_KEY = "pathways/encrypted";
export declare const PATHWAY_ENCRYPTION_SCHEME_METADATA_KEY = "pathways/encryption-scheme";
export declare const PATHWAY_ENCRYPTION_SCHEME = "aes-256-gcm-sha256-v1";
export type PathwayEncryptionMode = "none" | "symmetric";
export interface PathwayEncryptionConfig {
    mode?: PathwayEncryptionMode;
    key?: string;
}
export interface PathwayEncryptionProvider {
    encrypt(plaintext: string): string;
    decrypt(payload: string): string;
}
export declare function deriveEncryptionKey(secret: string): Buffer;
export declare function aesGcmEncrypt(plaintext: string, key: Buffer): string;
export declare function aesGcmDecrypt(payload: string, key: Buffer): string;
export declare function createPathwayEncryptionProvider(config?: PathwayEncryptionConfig): PathwayEncryptionProvider | null;
export declare function encryptPayloadEnvelope(payload: unknown, provider: PathwayEncryptionProvider): Record<string, string>;
/**
 * Removes the pathway encryption markers from event metadata.
 *
 * The markers describe the payload as it was written to Flowcore. Once the payload has been
 * decrypted they no longer hold, so they are dropped to keep the event self-consistent and to stop
 * a later pass (cluster mode re-enters `process()` through the cluster event handler) from trying
 * to decrypt the now-plaintext payload.
 *
 * Returns a new object; the input is left untouched.
 */
export declare function stripPathwayEncryptionMetadata(metadata: unknown): unknown;
export declare function decryptPayloadEnvelope(payload: unknown, provider: PathwayEncryptionProvider): unknown;
//# sourceMappingURL=encryption.d.ts.map