/**
 * Credential Encryption Utilities
 *
 * AES-256-GCM encryption with scrypt-derived keys for credential payloads.
 * Uses a per-install master.key file (mode 0600) as the base key material.
 *
 * File format:
 *   [1 byte: version=1] [12 bytes: IV] [16 bytes: auth tag] [N bytes: ciphertext]
 *
 * Threat model:
 * - Primary defense: file exfiltration via backup / cloud sync / screen capture
 * - NOT a defense against a compromised local user account or malicious code
 *   running as the user (both can read master.key and derive the same key)
 *
 * @module utils/encryption.utils
 */
/**
 * Clear the derived-key cache. Primarily for tests — production code should
 * not need this as master.key is assumed stable for the process lifetime.
 */
export declare function _resetDerivedKeyCache(): void;
/**
 * Ensure a master.key file exists at the given path. If absent, generate
 * a cryptographically random 32-byte key and write it with mode 0600.
 *
 * Idempotent: if the file already exists, does nothing.
 *
 * @param masterKeyPath - Absolute path to the master.key file
 */
export declare function ensureMasterKey(masterKeyPath: string): Promise<void>;
/**
 * Encrypt a UTF-8 string using AES-256-GCM.
 *
 * @param plaintext - The string to encrypt (caller typically JSON-serializes first)
 * @param masterKeyPath - Absolute path to the master.key file
 * @returns Buffer in the format `[version][iv][tag][ciphertext]`
 */
export declare function encrypt(plaintext: string, masterKeyPath: string): Promise<Buffer>;
/**
 * Decrypt a buffer produced by `encrypt()`.
 *
 * @param encrypted - Buffer in the `[version][iv][tag][ciphertext]` format
 * @param masterKeyPath - Absolute path to the master.key file
 * @returns The decrypted UTF-8 string
 * @throws Error if the buffer is malformed, the version is unsupported,
 *         or the auth tag does not match (tampering or wrong key)
 */
export declare function decrypt(encrypted: Buffer, masterKeyPath: string): Promise<string>;
/**
 * Default credentials directory: `~/.crewly/credentials/`.
 */
export declare function defaultCredentialsDir(): string;
/**
 * Default master.key path: `~/.crewly/credentials/master.key`.
 */
export declare function defaultMasterKeyPath(): string;
//# sourceMappingURL=encryption.utils.d.ts.map