export interface DerivedKey {
    key: Buffer;
    salt: Buffer;
}
/**
 * Derive a 256-bit encryption key from a password using Argon2id.
 * If salt is provided, uses it (for existing repos). Otherwise generates a new one.
 */
export declare function deriveKey(password: string, salt?: Buffer): Promise<DerivedKey>;
/**
 * Encrypt plaintext data using XChaCha20-Poly1305.
 * Returns: nonce (12 bytes) + authTag (16 bytes) + ciphertext
 */
export declare function encrypt(data: Buffer, key: Buffer): Buffer;
/**
 * Decrypt data encrypted with encrypt().
 * Expects: nonce (12 bytes) + authTag (16 bytes) + ciphertext
 */
export declare function decrypt(data: Buffer, key: Buffer): Buffer;
/**
 * Quick fingerprint of the derived key — used to verify password matches
 * without storing the key itself. Stored in the repo as verification.
 */
export declare function keyFingerprint(key: Buffer): string;
//# sourceMappingURL=encryption.d.ts.map