import { type IE2EPayload, type ISyncConfigResponse } from './types';
declare class E2ECryptoService {
    generateE2EPayload(config: string, pin: string): {
        payload: IE2EPayload;
        dek: Buffer;
    };
    encryptConfig(config: string, dek: Buffer): string;
    decryptConfig(encryptedConfig: string, dek: Buffer): string;
    wrapDEK(dek: Buffer, pin: string, salt: Buffer): string;
    unwrapDEK(encryptedDEK: string, pin: string, salt: Buffer): Buffer;
    decodeSalt(saltBase64: string): Buffer;
    private deriveKEK;
    private encryptWithKey;
    private decryptWithKey;
}
/**
 * Ensure encrypted payload includes a client KEK salt for E2E decryption.
 */
declare const requireClientKekSalt: (res: ISyncConfigResponse) => string;
/**
 * Ensure encrypted payload includes an encrypted DEK for E2E decryption.
 */
declare const requireClientDekEncrypted: (res: ISyncConfigResponse) => string;
export { E2ECryptoService, requireClientDekEncrypted, requireClientKekSalt };