/**
 * At-rest encryption for the Brain corpus (AES-256-GCM).
 *
 * Threat model, honestly stated: the key lives next to the data (`.brain.key`, mode
 * 0600), so this does NOT protect against an attacker with your uid — it protects the
 * corpus at rest against everything else: backups, dotfile sync, disk disposal, a
 * teammate peeking at a shared machine, a stolen laptop with full-disk encryption off.
 * Combined with scrub-on-store (no live secrets ever reach the corpus), the NDJSON on
 * disk holds redacted, encrypted text.
 *
 * Key resolution, in order: LEMMA_BRAIN_KEY env (64-char hex or base64 of 32 bytes, so
 * teams can share one key out-of-band) → `<brainDir>/.brain.key` → generate-and-store
 * (0600) when LEMMA_BRAIN_ENCRYPT=1. No env and no key file means disabled: plaintext,
 * exactly as before, byte for byte.
 *
 * Failure contract: key CONFIGURATION errors (malformed env key, corrupt key file)
 * throw loud — silently storing plaintext while the operator believes otherwise is the
 * one unacceptable outcome. DECRYPTION failures (wrong key, tampered bytes) return null
 * and flow into the corpus integrity fallback (backup → quarantine → fresh start),
 * never an exception, never half a corpus.
 */
export declare const BRAIN_ENC_MAGIC = "LEMMA-ENC-V1:";
export declare function brainKeyFile(brainDir: string): string;
/**
 * Resolve the data key, or null when encryption is off. Throws on malformed key
 * configuration (see module contract). Callers cache the result per process (see
 * TheBrainV2): rotating the key requires a restart, which is the safe direction —
 * a mid-process key change must never split one corpus across two keys.
 */
export declare function resolveBrainKey(brainDir: string): Buffer | null;
export declare function encryptionActive(brainDir: string): {
    enabled: boolean;
    keySource: 'env' | 'file' | null;
};
export declare function encryptEnvelope(key: Buffer, plain: string): string;
/** Null on wrong key, tampered bytes, or malformed envelope — never throws. */
export declare function decryptEnvelope(key: Buffer, stored: string): string | null;
//# sourceMappingURL=BrainEncryption.d.ts.map