import { SecretResolver } from "@graphorin/core/contracts";

//#region src/secrets/resolvers/encrypted-file.d.ts

/**
 * On-disk format of an encrypted bundle:
 *
 * ```text
 * [4 bytes] magic version (0x01000000 little-endian)
 * [16 bytes] Argon2id salt (random per bundle)
 * [12 bytes] AES-256-GCM nonce (random per bundle)
 * [N bytes]  AES-256-GCM ciphertext
 * [16 bytes] AES-256-GCM authentication tag
 * ```
 *
 * The ciphertext, once decrypted, is UTF-8 JSON of the shape
 * `{ values: Record<string, string>, meta: { createdAt: string } }`.
 *
 * The bundle is read end-to-end, decrypted with the passphrase derived
 * via Argon2id, and the requested fragment (`#field`) is selected from
 * the values map. JSON-pointer style fragments (`#/path/to/field`) are
 * supported for nested objects (post-MVP).
 *
 * @stable
 */
declare const ENCRYPTED_FILE_MAGIC = 16777216;
/**
 * Signature of the argon2id KDF the encrypted-file resolver calls -
 * swappable via `_setArgon2idForTesting`.
 *
 * @stable
 */
type Argon2idFn = (password: Buffer | string, options: {
  salt: Buffer;
  memoryCost: number;
  timeCost: number;
  parallelism: number;
  outputLen: number;
}) => Promise<Buffer>;
/**
 * Test-only override.
 *
 * @experimental
 */
declare function _setArgon2idForTesting(fn: Argon2idFn | null): void;
/**
 * Derive a 32-byte AES-256-GCM key from a passphrase + salt.
 *
 * @stable
 */
declare function deriveAesKey(passphrase: Buffer | string, salt: Buffer): Promise<Buffer>;
/**
 * Decrypt a raw bundle into the values map. Used by the resolver and by
 * the `EncryptedFileSecretsStore` so the wire format stays in one place.
 *
 * @stable
 */
declare function decryptBundle(bundle: Buffer, passphrase: Buffer | string): Promise<{
  values: Record<string, unknown>;
  meta: Record<string, unknown>;
}>;
/**
 * Resolver for `encrypted-file:` SecretRefs.
 *
 * @stable
 */
declare const encryptedFileResolver: SecretResolver;
//#endregion
export { Argon2idFn, ENCRYPTED_FILE_MAGIC, _setArgon2idForTesting, decryptBundle, deriveAesKey, encryptedFileResolver };
//# sourceMappingURL=encrypted-file.d.ts.map