export interface DecryptedFactorySecret<T> {
    value: T;
    needsReencryption: boolean;
}
/** Encrypts opaque JSON values before they cross the Factory storage boundary. */
export interface FactorySecretEncryption {
    encrypt<T>(value: T): Promise<string>;
    decrypt<T>(value: unknown): Promise<DecryptedFactorySecret<T>>;
}
export interface FactorySecretEncryptionKey {
    id: string;
    key: Uint8Array;
}
export interface FactorySecretEncryptionConfig {
    primary: FactorySecretEncryptionKey;
    previous?: FactorySecretEncryptionKey[];
}
/**
 * Creates a versioned AES-256-GCM encryptor. The primary key is used for new
 * writes; previous keys remain decrypt-only until stored values are rotated.
 */
export declare function createFactorySecretEncryption(config: FactorySecretEncryptionConfig): FactorySecretEncryption;
/** Explicit plaintext compatibility for local, no-auth Factory development. */
export declare function createPlaintextFactorySecretEncryption(): FactorySecretEncryption;
//# sourceMappingURL=secret-encryption.d.ts.map