/**
 * Key Derivation Functions
 *
 * Uses Argon2id for recovery phrase to key derivation and HKDF for
 * deriving auth and encryption keys.
 *
 * Implementation note (1.3.0): switched from the native `argon2` npm
 * package to `@noble/hashes/argon2id` (pure JS). Eliminates the native
 * binding that crashed when OpenClaw's `npm install --ignore-scripts`
 * skipped the postinstall binary download. Same algorithm + same
 * parameters → output is byte-identical to the native implementation.
 */
/**
 * Key derivation parameters
 */
export interface KeyDerivationParams {
    /** Memory cost parameter for Argon2id (default: 65536 KB = 64 MB) */
    memoryCost?: number;
    /** Time cost parameter for Argon2id (default: 3 iterations) */
    timeCost?: number;
    /** Parallelism parameter for Argon2id (default: 4) */
    parallelism?: number;
}
/**
 * Default KDF parameters (OWASP recommendations)
 */
export declare const DEFAULT_KDF_PARAMS: Required<Omit<KeyDerivationParams, 'salt'>>;
/**
 * Generate a random salt for key derivation
 * @param length - Salt length in bytes (default: 32)
 * @returns Random salt buffer
 */
export declare function generateSalt(length?: number): Buffer;
/**
 * Derive the auth key from recovery phrase using Argon2id + HKDF
 *
 * The auth key is used for server authentication (HMAC operations).
 *
 * @param masterPassword - User's recovery phrase
 * @param salt - Random salt
 * @param params - KDF parameters
 * @returns 32-byte auth key hash
 */
export declare function deriveAuthKey(masterPassword: string, salt: Buffer, params?: KeyDerivationParams): Promise<Buffer>;
/**
 * Derive the encryption key from recovery phrase using Argon2id + HKDF
 *
 * The encryption key is used for XChaCha20-Poly1305 encryption of documents and embeddings.
 *
 * @param masterPassword - User's recovery phrase
 * @param salt - Random salt
 * @param params - KDF parameters
 * @returns 32-byte encryption key
 */
export declare function deriveEncryptionKey(masterPassword: string, salt: Buffer, params?: KeyDerivationParams): Promise<Buffer>;
/**
 * Derive both auth and encryption keys from recovery phrase
 *
 * This is more efficient than calling deriveAuthKey and deriveEncryptionKey
 * separately because it only runs Argon2id once.
 *
 * @param masterPassword - User's recovery phrase
 * @param salt - Random salt
 * @param params - KDF parameters
 * @returns Object containing both auth and encryption keys
 */
export declare function deriveKeys(masterPassword: string, salt: Buffer, params?: KeyDerivationParams): Promise<{
    authKey: Buffer;
    encryptionKey: Buffer;
}>;
/**
 * Create HMAC-SHA256 authentication proof
 *
 * @param key - Auth key
 * @param data - Data to authenticate
 * @returns HMAC digest
 */
export declare function createAuthProof(key: Buffer, data: Buffer): Buffer;
/**
 * Verify HMAC-SHA256 authentication proof
 *
 * @param key - Auth key
 * @param data - Data to verify
 * @param proof - Expected HMAC digest
 * @returns True if verification succeeds
 */
export declare function verifyAuthProof(key: Buffer, data: Buffer, proof: Buffer): boolean;
//# sourceMappingURL=kdf.d.ts.map