/**
 * Encryption Utility
 *
 * Provides AES-256-GCM encryption/decryption for sensitive data.
 * Used for securing session data and other sensitive information.
 *
 * Security Features:
 * - AES-256-GCM encryption with authentication
 * - PBKDF2 key derivation with salt
 * - Secure random IV generation
 * - Tamper detection with authentication tags
 * - Configurable key management
 */
/**
 * Extended decipher interface with GCM-specific methods
 */
export interface DecryptionResult {
    data?: string;
    error?: string;
    success: boolean;
}
export interface EncryptedData {
    encrypted: string;
    iv: string;
    salt: string;
    tag?: string;
    version: number;
}
export interface EncryptionOptions {
    algorithm?: string;
    iterations?: number;
    ivLength?: number;
    keyLength?: number;
    saltLength?: number;
}
/**
 * Encryption Utility Class
 *
 * Handles encryption/decryption of sensitive data with strong cryptographic practices.
 */
export declare class EncryptionUtil {
    private masterKey?;
    private options;
    constructor(options?: EncryptionOptions, masterKey?: string);
    /**
     * Encrypt data using AES-256-GCM
     */
    encrypt(data: string, password?: string): EncryptedData;
    /**
     * Decrypt data using AES-256-GCM (v2+) or AES-256-CBC (v1) for backward compatibility
     */
    decrypt(encryptedData: EncryptedData, password?: string): DecryptionResult;
    /**
     * Encrypt sensitive fields in an object
     */
    encryptObjectFields<T extends Record<string, unknown>>(obj: T, sensitiveFields: string[], password?: string): T;
    /**
     * Decrypt sensitive fields in an object
     */
    decryptObjectFields<T extends Record<string, unknown>>(obj: T, sensitiveFields: string[], password?: string): T;
    /**
     * Check if data looks like encrypted data
     */
    private isEncryptedData;
    /**
     * Check if encrypted data uses GCM (version 2+) or legacy CBC (version 1)
     */
    private isGCMData;
    /**
     * Get or generate master key
     * In production, this should be loaded from secure key management
     */
    private getMasterKey;
    /**
     * Load a previously-persisted random fallback key, or generate and persist
     * a new one. A persisted random key is both stable across process restarts
     * (data encrypted under a prior run stays decryptable) and not guessable
     * from public machine information (hostname, etc.) — unlike the previous
     * approach of deriving from `${machineId}:${appId}:${Date.now()}`, which
     * was neither: the timestamp made it unstable across restarts, without
     * ever making it any less derivable from public machine data.
     */
    private loadOrCreatePersistedFallbackKey;
    /**
     * Generate a secure random password/key
     */
    static generateSecureKey(length?: number): string;
    /**
     * Validate encryption configuration
     */
    validateConfig(): {
        errors: string[];
        valid: boolean;
    };
}
export declare const SENSITIVE_SESSION_FIELDS: string[];
/**
 * Get the global encryption utility instance
 */
export declare function getEncryptionUtil(options?: EncryptionOptions, masterKey?: string): EncryptionUtil;
/**
 * Set a custom global encryption utility instance
 */
export declare function setEncryptionUtil(util: EncryptionUtil): void;
/**
 * Encrypt sensitive session data
 */
export declare function encryptSessionData<T extends Record<string, unknown>>(sessionData: T): T;
/**
 * Decrypt sensitive session data
 */
export declare function decryptSessionData<T extends Record<string, unknown>>(sessionData: T): T;
/**
 * Encrypt a single value
 */
export declare function encryptValue(value: string): EncryptedData;
/**
 * Decrypt a single value
 */
export declare function decryptValue(encryptedData: EncryptedData): DecryptionResult;
//# sourceMappingURL=encryption.d.ts.map