import { DecryptOptions, EncryptOptions, LegacyCipherDriver } from "./types.mjs";

//#region ../encryption/src/encryption.d.ts
/**
 * Return md5 hashed string
 *
 * @deprecated MD5 is collision-broken. Never use it for passwords, signatures
 * or integrity checks — it is exported for legacy interop (cache keys,
 * gravatar-style identifiers) only.
 *
 * @param {string} text
 * @returns {string}
 */
declare function md5(text: string): string;
/**
 * Return sha1 hashed string
 *
 * @deprecated SHA-1 is collision-broken. Never use it for passwords,
 * signatures or integrity checks — it is exported for legacy interop only.
 *
 * @param {string} text
 * @returns {string}
 */
declare function sha1(text: string): string;
/**
 * Return sha256 hashed string
 *
 * @param {string} text
 * @returns {string}
 */
declare function sha256(text: string): string;
/**
 * Return sha512 hashed string
 *
 * @param {string} text
 * @returns {string}
 */
declare function sha512(text: string): string;
/**
 * Encrypt the given value with AES-256-GCM.
 *
 * The key is stretched with PBKDF2-HMAC-SHA256 over a fresh random salt, and
 * the payload is sealed under a fresh random 96-bit nonce; both are stored in
 * the returned envelope. Two calls with the same value and key therefore never
 * produce the same string, and any edit to the returned string makes
 * {@link decrypt} reject rather than return altered data.
 *
 * @breaking-change v2 — this is `async`. v1.x returned the ciphertext directly.
 *
 * @param {any} value any JSON-encodable value
 * @param {string} key
 * @param {EncryptOptions} options
 * @returns {Promise<string>} base64 envelope
 */
declare function encrypt(value: any, key?: string, options?: EncryptOptions): Promise<string>;
/**
 * Decrypt the given ciphertext and return its original value.
 *
 * @breaking-change v2 — this is `async`, and it **throws** a
 * {@link DecryptionError} on a wrong key, a tampered envelope or a malformed
 * input, where v1.x returned `null`. Failing loudly is the entire point of
 * moving to an authenticated cipher: a returned `null` cannot be distinguished
 * from a legitimately encrypted `null`. Use {@link tryDecrypt} for the old
 * null-on-failure shape.
 *
 * @param {string} cypher
 * @param {string} key
 * @param {DecryptOptions|LegacyCipherDriver} options a v1.x cipher driver is
 *        accepted here and read as `{ legacyDriver, legacyDecryption: true }`.
 * @returns {Promise<any>}
 */
declare function decrypt(cypher: string, key?: string, options?: DecryptOptions | LegacyCipherDriver): Promise<any>;
/**
 * Decrypt, returning `null` instead of throwing when the ciphertext cannot be
 * authenticated.
 *
 * This is the v1.x failure shape, for callers that genuinely do not care why a
 * value failed to decrypt. Note the ambiguity it carries: `encrypt(null)`
 * round-trips to `null` too, so `null` here means "no usable value", not
 * "failure". Prefer {@link decrypt}.
 *
 * @param {string} cypher
 * @param {string} key
 * @param {DecryptOptions|LegacyCipherDriver} options
 * @returns {Promise<any|null>}
 */
declare function tryDecrypt(cypher: string, key?: string, options?: DecryptOptions | LegacyCipherDriver): Promise<any>;
//#endregion
export { decrypt, encrypt, md5, sha1, sha256, sha512, tryDecrypt };
//# sourceMappingURL=encryption.d.mts.map