export declare class InvalidPinError extends Error {
    constructor();
    static isInstance(obj: unknown): obj is InvalidPinError;
}
export declare abstract class KeyStorage {
    abstract get value(): string;
    static isInstance(obj: unknown): obj is KeyStorage;
    /**
     * Is the storage locked
     */
    abstract shouldUnlock(): boolean;
    abstract unlock(code: string): Promise<void>;
    /**
     * Get a payload object which can be serialized to JSON
     */
    abstract toPayload(): Object;
    /**
     * Create a key storage class from its payload
     */
    static fromPayload(o: object): NotEncrypted | PinEncrypted;
}
/**
 * Pin protected data
 *
 * Encryption scheme (encrypt-then-MAC with key separation):
 *   masterKey  = scrypt(pin, salt)
 *   encKey     = HKDF(masterKey, salt, info="pin-enc")   — 32 bytes
 *   macKey     = HKDF(masterKey, salt, info="pin-mac")   — 32 bytes
 *   ciphertext = XChaCha20(encKey, nonce, plaintext)
 *   mac        = HMAC-SHA256(macKey, nonce || ciphertext) — verified before decryption
 */
export declare class PinEncrypted extends KeyStorage {
    #private;
    constructor(enc: PinEncryptedPayload);
    get value(): string;
    shouldUnlock(): boolean;
    unlock(pin: string): Promise<void>;
    toPayload(): PinEncryptedPayload;
    static create(content: string, pin: string): Promise<PinEncrypted>;
}
export declare class NotEncrypted extends KeyStorage {
    #private;
    constructor(key: string);
    get value(): string;
    shouldUnlock(): boolean;
    unlock(code: string): Promise<void>;
    toPayload(): Object;
}
export interface PinEncryptedPayload {
    /** Format version. v2 = encrypt-then-MAC with HKDF key separation. Absence = legacy v1. */
    v?: number;
    salt: string;
    ciphertext: string;
    iv: string;
    mac: string;
}
//# sourceMappingURL=pin-encrypted.d.ts.map