/**
 * Post-Quantum Cryptographic Utilities for NotebookLM MCP Server
 *
 * Provides quantum-resistant encryption at rest using hybrid encryption:
 * - ML-KEM-768 (Kyber) for post-quantum key encapsulation
 * - ChaCha20-Poly1305 for symmetric encryption (NOT AES-GCM)
 * - PBKDF2 for key derivation from passwords
 * - Machine-derived keys (fallback)
 *
 * Why ChaCha20-Poly1305 over AES-GCM:
 * - Constant-time by design (no cache timing side-channels)
 * - Faster in software without hardware AES-NI
 * - Simpler construction, less prone to implementation errors
 * - Used by Google, Cloudflare for TLS
 *
 * This hybrid approach ensures:
 * 1. Current security via ChaCha20-Poly1305
 * 2. Future quantum resistance via ML-KEM-768
 *
 * Added by Pantheon Security for hardened fork.
 */
/// <reference types="node" resolution-mode="require"/>
/// <reference types="node" resolution-mode="require"/>
/**
 * Encryption configuration
 */
export interface EncryptionConfig {
    /** Enable encryption (default: true) */
    enabled: boolean;
    /** User-provided encryption key (base64) */
    key?: string;
    /** Key file path */
    keyFile?: string;
    /** Use machine-derived key as fallback */
    useMachineKey: boolean;
    /** PBKDF2 iterations (default: 600000) */
    pbkdf2Iterations: number;
    /** Use post-quantum encryption (default: true) */
    usePostQuantum: boolean;
}
/**
 * Post-Quantum encrypted data format (hybrid encryption)
 */
interface PQEncryptedData {
    version: number;
    algorithm: string;
    pqAlgorithm: string;
    encapsulatedKey: string;
    nonce: string;
    salt: string;
    ciphertext: string;
}
/**
 * Classical encrypted data format (fallback)
 */
interface ClassicalEncryptedData {
    version: number;
    algorithm: string;
    nonce: string;
    salt?: string;
    ciphertext: string;
}
/**
 * Thrown when an encrypted file exists but cannot be decrypted (e.g. wrong
 * key after rotation, corruption, or tampering). Distinct from a genuinely
 * absent file (load() returns null), so callers can avoid overwriting
 * good-but-undecryptable state.
 */
export declare class DecryptionError extends Error {
    readonly file: string;
    constructor(message: string, file: string);
}
/**
 * Derive a key from a passphrase using PBKDF2
 */
export declare function deriveKey(passphrase: string, salt: Buffer, iterations?: number): Buffer;
export declare function getOrCreateMachineKey(keyPath: string): Buffer;
/**
 * Generate ML-KEM key pair for post-quantum encryption
 */
export declare function generatePQKeyPair(): {
    publicKey: Uint8Array;
    secretKey: Uint8Array;
};
/**
 * Encrypt data using hybrid post-quantum encryption
 * ML-KEM-768 + ChaCha20-Poly1305
 *
 * Process:
 * 1. Encapsulate a shared secret using recipient's public key (ML-KEM-768)
 * 2. Derive ChaCha20 key from shared secret + salt
 * 3. Encrypt data with ChaCha20-Poly1305 (AEAD)
 */
export declare function encryptPQ(data: string | Buffer, recipientPublicKey: Uint8Array): PQEncryptedData;
/**
 * Decrypt data using hybrid post-quantum decryption
 * ML-KEM-768 + ChaCha20-Poly1305
 */
export declare function decryptPQ(encryptedData: PQEncryptedData, recipientSecretKey: Uint8Array): Buffer;
/**
 * Classical ChaCha20-Poly1305 encryption (fallback)
 */
export declare function encryptClassical(data: string | Buffer, key: Buffer): ClassicalEncryptedData;
/**
 * Classical ChaCha20-Poly1305 decryption (fallback)
 */
export declare function decryptClassical(encryptedData: ClassicalEncryptedData, key: Buffer): Buffer;
/**
 * Post-Quantum Secure Storage Class
 *
 * Provides encrypted file storage using hybrid post-quantum encryption
 * with ChaCha20-Poly1305 (NOT AES-GCM).
 */
export declare class SecureStorage {
    private config;
    private classicalKey;
    private pqKeyPair;
    private initialized;
    private keyStorePath;
    /**
     * Captured at construction, before config.enabled can be mutated by
     * initialize()/initializeClassicalKey(). Records whether the caller
     * actually intended encryption. Used to fail closed: if encryption was
     * expected but is unavailable, we refuse to write plaintext.
     */
    private readonly encryptionExpected;
    constructor(config?: Partial<EncryptionConfig>);
    /**
     * Initialize the secure storage (derive/load keys)
     */
    initialize(): Promise<void>;
    /**
     * Initialize classical encryption key
     */
    private initializeClassicalKey;
    /**
     * Initialize post-quantum keys
     */
    private initializePQKeys;
    /**
     * Save PQ keys with ChaCha20-Poly1305 encryption
     */
    private savePQKeys;
    /**
     * Save data to an encrypted file
     */
    save(filePath: string, data: string | object): Promise<void>;
    /**
     * Load data from an encrypted file
     */
    load(filePath: string): Promise<string | null>;
    /**
     * Load JSON data from an encrypted file
     */
    loadJSON<T>(filePath: string): Promise<T | null>;
    /**
     * Delete an encrypted file
     */
    delete(filePath: string): Promise<boolean>;
    /**
     * Check if a file exists (any encrypted or unencrypted version)
     */
    exists(filePath: string): boolean;
    /**
     * Get encryption status
     */
    getStatus(): {
        enabled: boolean;
        classicalKeySource: string;
        postQuantumEnabled: boolean;
        algorithm: string;
        pqAlgorithm: string | null;
    };
    /**
     * Generate a new random encryption key (classical)
     */
    static generateKey(): string;
    /**
     * Export public key for sharing (e.g., for external encryption)
     */
    getPublicKey(): string | null;
}
/**
 * Get or create the global secure storage
 */
export declare function getSecureStorage(): SecureStorage;
export {};