import type { APICommand } from '../index.js';
import type { Secret } from './secret-flags.js';
import { Result } from '../result.js';
/**
 * Decrypts an encrypted config value
 * Based on @quonfig/node/src/encryption.ts
 * @param {string} encryptedString - The encrypted string in format: encryptedData--IV--authTag
 * @param {string} keyStringHex - The encryption key as a 64-character hex string
 * @returns {string} The decrypted plaintext value
 */
export declare function decrypt(encryptedString: string, keyStringHex: string): string;
/**
 * Creates an encrypted ConfigValue using the new v1 API endpoints
 * @param command - The APICommand instance for API calls and logging
 * @param value - The plaintext value to encrypt
 * @param secret - Secret configuration containing key name
 * @param environmentName - Environment slug to fetch encryption key for (empty string for default).
 *   Must be the slug stored in config files (e.g. "production"), not the DB UUID — the encryption
 *   key config's `environments[].id` holds slugs, and matching against UUIDs silently falls back
 *   to the default key and produces ciphertext that won't decrypt at runtime.
 * @returns Result<ConfigValue> with encrypted value or error
 */
export declare function makeConfidentialValue(command: APICommand, value: string, secret: Secret, environmentName: string): Promise<Result<any>>;