/**
 * Generate a cryptographically random salt for PBKDF2 key derivation.
 * Should be called once during `aegis init` and persisted alongside the master key.
 */
export declare function generateSalt(): string;
/**
 * Derives a 256-bit encryption key from the master key using PBKDF2.
 *
 * @param masterKey  High-entropy master secret
 * @param salt       Per-deployment salt (use {@link generateSalt} to create one)
 */
export declare function deriveKey(masterKey: string, salt?: Buffer | string): Buffer;
export interface EncryptedData {
    encrypted: Buffer;
    iv: Buffer;
    authTag: Buffer;
}
/**
 * Encrypts a plaintext credential using AES-256-GCM.
 * Accepts a pre-derived key so callers can cache the expensive PBKDF2 result.
 */
export declare function encrypt(plaintext: string, key: Buffer): EncryptedData;
/**
 * Decrypts an AES-256-GCM encrypted credential.
 * Accepts a pre-derived key so callers can cache the expensive PBKDF2 result.
 */
export declare function decrypt(data: EncryptedData, key: Buffer): string;
//# sourceMappingURL=crypto.d.ts.map