import { EncryptedEnvelope } from './types.js';
/**
 * Core envelope encryption primitives using AES-256-GCM
 *
 * This class provides the cryptographic operations for envelope encryption:
 * - Generate data encryption keys (DEKs)
 * - Wrap/unwrap DEKs with a master key
 * - Encrypt/decrypt data with DEKs
 *
 * @example
 * ```typescript
 * // Generate a new data key
 * const dataKey = EnvelopeEncryption.generateDataKey();
 *
 * // Wrap the data key with an AMK
 * const wrapped = EnvelopeEncryption.wrapKey(dataKey, amk);
 *
 * // Encrypt data with the data key
 * const encrypted = EnvelopeEncryption.encryptData('secret', dataKey);
 *
 * // Later: unwrap and decrypt
 * const unwrappedKey = EnvelopeEncryption.unwrapKey(wrapped.wrappedKey, wrapped.iv, wrapped.authTag, amk);
 * const plaintext = EnvelopeEncryption.decryptData(encrypted.ciphertext, encrypted.iv, encrypted.authTag, unwrappedKey);
 * ```
 */
export declare class EnvelopeEncryption {
    private static readonly ALGORITHM;
    private static readonly KEY_LENGTH;
    private static readonly IV_LENGTH;
    private static readonly AUTH_TAG_LENGTH;
    /**
     * Generate a new random data encryption key
     *
     * @returns A 32-byte (256-bit) random key
     */
    static generateDataKey(): Buffer;
    /**
     * Generate a random IV for encryption
     *
     * @returns A 12-byte (96-bit) random IV
     */
    static generateIV(): Buffer;
    /**
     * Wrap (encrypt) a data encryption key with a master key
     *
     * @param dataKey - The data key to wrap (32 bytes)
     * @param masterKey - The master key to wrap with (32 bytes)
     * @returns Object containing wrapped key, IV, and auth tag (all base64-encoded)
     */
    static wrapKey(dataKey: Buffer, masterKey: Buffer): {
        wrappedKey: string;
        iv: string;
        authTag: string;
    };
    /**
     * Unwrap (decrypt) a data encryption key with a master key
     *
     * @param wrappedKey - Base64-encoded wrapped key
     * @param iv - Base64-encoded IV
     * @param authTag - Base64-encoded authentication tag
     * @param masterKey - The master key to unwrap with (32 bytes)
     * @returns The unwrapped data key (32 bytes)
     * @throws Error if decryption fails (invalid key, tampered data, etc.)
     */
    static unwrapKey(wrappedKey: string, iv: string, authTag: string, masterKey: Buffer): Buffer;
    /**
     * Encrypt data with a data encryption key
     *
     * @param plaintext - The plaintext string to encrypt
     * @param dataKey - The data encryption key (32 bytes)
     * @returns Object containing ciphertext, IV, and auth tag (all base64-encoded)
     */
    static encryptData(plaintext: string, dataKey: Buffer): {
        ciphertext: string;
        iv: string;
        authTag: string;
    };
    /**
     * Decrypt data with a data encryption key
     *
     * @param ciphertext - Base64-encoded ciphertext
     * @param iv - Base64-encoded IV
     * @param authTag - Base64-encoded authentication tag
     * @param dataKey - The data encryption key (32 bytes)
     * @returns The decrypted plaintext string
     * @throws Error if decryption fails (invalid key, tampered data, etc.)
     */
    static decryptData(ciphertext: string, iv: string, authTag: string, dataKey: Buffer): string;
    /**
     * Create a full encrypted envelope
     *
     * This combines key wrapping and data encryption into a single envelope
     * that can be stored and later decrypted.
     *
     * @param plaintext - The plaintext string to encrypt
     * @param dataKey - The data encryption key (32 bytes)
     * @param wrappedKeyInfo - The wrapped key info (from wrapKey)
     * @param amkKeyId - The ID of the AMK used to wrap the key
     * @param metadata - Optional metadata to include in the envelope
     * @returns A complete encrypted envelope
     */
    static createEnvelope(plaintext: string, dataKey: Buffer, wrappedKeyInfo: {
        wrappedKey: string;
        iv: string;
        authTag: string;
    }, amkKeyId: string, metadata?: Record<string, string>): EncryptedEnvelope;
    /**
     * Parse a combined wrapped key string
     *
     * @param combinedWrappedKey - The combined wrapped key string (wrappedKey:iv:authTag)
     * @returns Object with wrappedKey, iv, and authTag
     */
    static parseWrappedKey(combinedWrappedKey: string): {
        wrappedKey: string;
        iv: string;
        authTag: string;
    };
    /**
     * Decrypt a full envelope
     *
     * @param envelope - The encrypted envelope
     * @param masterKey - The master key to unwrap the data key
     * @returns The decrypted plaintext string
     */
    static decryptEnvelope(envelope: EncryptedEnvelope, masterKey: Buffer): string;
    /**
     * Validate that a key is the correct length
     *
     * @param key - The key to validate
     * @param expectedLength - Expected length in bytes (default: 32)
     * @throws Error if key length is invalid
     */
    static validateKeyLength(key: Buffer, expectedLength?: number): void;
    /**
     * Parse a hex-encoded key from string
     *
     * @param hexKey - Hex-encoded key string (64 chars for 32 bytes)
     * @returns The key as a Buffer
     * @throws Error if the hex string is invalid
     */
    static parseHexKey(hexKey: string): Buffer;
}
//# sourceMappingURL=envelope.d.ts.map