import { EncryptedSessionKey, KeyPair } from '../types';
/**
 * Error class for cryptographic operations
 */
export declare class CryptoError extends Error {
    constructor(message: string);
}
/**
 * Current encryption version for future algorithm upgrades
 */
export declare const ENCRYPTION_VERSION = 1;
/**
 * Service for end-to-end encryption operations
 */
export declare class CryptoService {
    private static instance;
    private constructor();
    static getInstance(): CryptoService;
    /**
     * Generate a new ECDH P-256 key pair
     * @returns Object with privateKey (base64), publicKey (base64 raw)
     */
    generateKeyPair(): KeyPair;
    /**
     * Generate a random 256-bit session key
     * @returns Base64-encoded session key
     */
    generateSessionKey(): string;
    /**
     * Derive a shared secret using ECDH and HKDF
     * @param privateKeyBase64 Our private key (base64)
     * @param publicKeyBase64 Other party's public key (base64)
     * @returns 256-bit derived key as Buffer
     */
    deriveSharedKey(privateKeyBase64: string, publicKeyBase64: string): Buffer;
    /**
     * Encrypt a session key for a target device using ECDH
     * @param sessionKeyBase64 The session key to encrypt (base64)
     * @param targetPublicKeyBase64 Target device's public key (base64)
     * @returns EncryptedSessionKey containing encrypted key and ephemeral public key
     */
    encryptSessionKey(sessionKeyBase64: string, targetPublicKeyBase64: string): Omit<EncryptedSessionKey, 'deviceId'>;
    /**
     * Decrypt a session key using our private key
     * @param encryptedSessionKey The encrypted session key data
     * @param privateKeyBase64 Our device's private key (base64)
     * @returns Decrypted session key (base64)
     */
    decryptSessionKey(encryptedSessionKey: EncryptedSessionKey, privateKeyBase64: string): string;
    /**
     * Encrypt content using AES-256-GCM
     * @param content String content to encrypt
     * @param sessionKeyBase64 Session key (base64)
     * @returns Base64-encoded ciphertext (nonce + ciphertext + tag)
     */
    encryptContent(content: string, sessionKeyBase64: string): string;
    /**
     * Decrypt content using AES-256-GCM
     * @param encryptedContent Base64-encoded ciphertext
     * @param sessionKeyBase64 Session key (base64)
     * @returns Decrypted string content
     */
    decryptContent(encryptedContent: string, sessionKeyBase64: string): string;
    /**
     * Encrypt JSON-serializable metadata
     * @param metadata Object to encrypt
     * @param sessionKeyBase64 Session key (base64)
     * @returns Base64-encoded encrypted JSON
     */
    encryptMetadata(metadata: Record<string, any>, sessionKeyBase64: string): string;
    /**
     * Decrypt encrypted metadata
     * @param encryptedMetadata Base64-encoded encrypted JSON
     * @param sessionKeyBase64 Session key (base64)
     * @returns Decrypted object
     */
    decryptMetadata(encryptedMetadata: string, sessionKeyBase64: string): Record<string, any>;
    /**
     * Encrypt binary data using AES-256-GCM
     * @param data Binary data to encrypt (Buffer)
     * @param sessionKeyBase64 Session key (base64)
     * @returns Encrypted data (Buffer containing nonce + ciphertext + tag)
     */
    encryptData(data: Buffer, sessionKeyBase64: string): Buffer;
    /**
     * Decrypt binary data using AES-256-GCM
     * @param encryptedData Encrypted data (Buffer containing nonce + ciphertext + tag)
     * @param sessionKeyBase64 Session key (base64)
     * @returns Decrypted binary data (Buffer)
     */
    decryptData(encryptedData: Buffer, sessionKeyBase64: string): Buffer;
    /**
     * Encrypt data using AES-256-GCM
     * @param data Data to encrypt
     * @param key Symmetric key (32 bytes)
     * @returns Combined nonce + ciphertext + tag
     */
    private encrypt;
    /**
     * Decrypt data using AES-256-GCM
     * @param data Combined nonce + ciphertext + tag
     * @param key Symmetric key (32 bytes)
     * @returns Decrypted data
     */
    private decrypt;
    /**
     * Serialize a private key for storage
     */
    serializePrivateKey(privateKeyBase64: string): string;
    /**
     * Deserialize a private key from storage
     */
    deserializePrivateKey(base64: string): string;
}
/**
 * Export singleton instance
 */
export declare const cryptoService: CryptoService;