/**
 * Elicitation Store Encryption
 *
 * Session-based encryption for elicitation store data.
 * Uses HKDF-SHA256 for key derivation and AES-256-GCM for encryption.
 *
 * Security Model:
 * - Each session gets a unique encryption key derived from sessionId + server secret
 * - Only requests with the actual sessionId can decrypt the elicitation data
 * - Zero-knowledge: Server storage contains only encrypted blobs
 *
 * @module elicitation/store/elicitation-encryption
 */
import { type EncBlob } from '@frontmcp/utils';
/**
 * Encrypted blob structure for elicitation storage.
 * Re-exports EncBlob from @frontmcp/utils for consistency.
 */
export type ElicitationEncryptedBlob = EncBlob;
/**
 * Configuration for elicitation encryption.
 */
export interface ElicitationEncryptionConfig {
    /**
     * Whether encryption is enabled.
     * @default true in production, false in development
     */
    enabled: boolean;
    /**
     * Server secret for key derivation.
     * Falls back to MCP_ELICITATION_SECRET or MCP_SESSION_SECRET env vars.
     */
    secret?: string;
}
/**
 * Get the base secret for elicitation encryption.
 * Checks environment variables in order of specificity.
 *
 * @returns The secret string, or null if not configured
 */
export declare function getElicitationSecret(): string | null;
/**
 * Check if elicitation encryption is available.
 * Returns true if a secret is configured via environment variables.
 */
export declare function isElicitationEncryptionAvailable(): boolean;
/**
 * Derive a session-specific encryption key using HKDF-SHA256.
 *
 * Key derivation:
 * - IKM (Input Key Material): serverSecret + sessionId
 * - Salt: "elicitation-store-v1"
 * - Info: "elicit:{sessionId}"
 * - Output: 32-byte (256-bit) key for AES-256-GCM
 *
 * This ensures each session gets a unique key that:
 * 1. Cannot be derived without knowing the server secret
 * 2. Is deterministic for a given sessionId (same key on all nodes)
 * 3. Is cryptographically isolated from other sessions
 *
 * @param sessionId - The session ID to derive a key for
 * @param secret - Optional secret override (defaults to env var)
 * @returns 32-byte encryption key
 * @throws ElicitationSecretRequiredError if no secret is available
 */
export declare function deriveElicitationKey(sessionId: string, secret?: string): Promise<Uint8Array>;
/**
 * Encrypt elicitation data using session-derived key.
 *
 * Uses AES-256-GCM for authenticated encryption:
 * - 12-byte random IV
 * - 16-byte authentication tag
 * - Ciphertext
 *
 * @param data - Data to encrypt (will be JSON serialized)
 * @param sessionId - Session ID for key derivation
 * @param secret - Optional secret override
 * @returns Encrypted blob
 */
export declare function encryptElicitationData<T>(data: T, sessionId: string, secret?: string): Promise<ElicitationEncryptedBlob>;
/**
 * Decrypt elicitation data using session-derived key.
 *
 * @param blob - Encrypted blob to decrypt
 * @param sessionId - Session ID for key derivation
 * @param secret - Optional secret override
 * @returns Decrypted and parsed value, or null if decryption fails
 */
export declare function decryptElicitationData<T>(blob: ElicitationEncryptedBlob, sessionId: string, secret?: string): Promise<T | null>;
/**
 * Serialize encrypted blob to a string for storage.
 */
export declare function serializeElicitationBlob(blob: ElicitationEncryptedBlob): string;
/**
 * Deserialize a string back to encrypted blob.
 * Returns null if the string is not a valid encrypted blob.
 */
export declare function deserializeElicitationBlob(str: string): ElicitationEncryptedBlob | null;
/**
 * Check if a value is an encrypted blob.
 * Used for migration: detecting encrypted vs. plaintext data.
 */
export declare function isEncryptedBlob(value: unknown): value is ElicitationEncryptedBlob;
/**
 * Encrypt and serialize in one step.
 *
 * @param data - Data to encrypt
 * @param sessionId - Session ID for key derivation
 * @param secret - Optional secret override
 * @returns Serialized encrypted blob string
 */
export declare function encryptAndSerialize<T>(data: T, sessionId: string, secret?: string): Promise<string>;
/**
 * Deserialize and decrypt in one step.
 *
 * @param str - Serialized encrypted blob string
 * @param sessionId - Session ID for key derivation
 * @param secret - Optional secret override
 * @returns Decrypted value, or null if decryption fails
 */
export declare function deserializeAndDecrypt<T>(str: string, sessionId: string, secret?: string): Promise<T | null>;
/**
 * Try to decrypt stored data.
 *
 * Similar to deserializeAndDecrypt but accepts parsed value directly.
 * Useful when the storage layer already parsed the JSON.
 *
 * @param value - Stored value (must be encrypted blob)
 * @param sessionId - Session ID for key derivation
 * @param secret - Optional secret override
 * @returns Decrypted value, or null if not encrypted or decryption fails
 */
export declare function tryDecryptStoredValue<T>(value: unknown, sessionId: string, secret?: string): Promise<T | null>;
//# sourceMappingURL=elicitation-encryption.d.ts.map