/**
 * AES-256-GCM symmetric encryption for the encrypted-file fallback tier.
 *
 * KEK strategy: derive a 256-bit key-encryption-key via scrypt from a
 * machine-local identifier (arbitrary string passed in by the caller —
 * typically a stable machine-id or data-dir path) plus a random 32-byte
 * salt stored alongside the ciphertext.
 *
 * Threat model (honest): this protects against casual/offline disk reads by
 * unprivileged users. It does NOT protect against a root attacker or anyone
 * who can read the salt file and reconstruct the machine-id. The keychain
 * tier is preferred precisely because it delegates secret storage to the OS
 * keyring which has stronger access controls.
 *
 * Wire format (binary, then base64-encoded):
 *   [ 4 bytes version ][ 32 bytes salt ][ 12 bytes IV ][ auth-tag 16 bytes ][ ciphertext ... ]
 *
 * version = 0x00000001 (big-endian uint32)
 */
/**
 * Encrypt a plaintext secret with AES-256-GCM.
 * Returns a base64-encoded blob (version + salt + IV + tag + ciphertext).
 */
export declare function encryptSecret(plaintext: string, machineId: string): Promise<string>;
/**
 * Decrypt a base64-encoded blob produced by encryptSecret.
 * Throws on any auth/format failure — callers must not silently ignore.
 */
export declare function decryptSecret(blob: string, machineId: string): Promise<string>;
/**
 * Encrypt a secret and write it atomically to filePath with 0o600 permissions.
 *
 * Atomic: writes to a temp file (also 0o600 — no world-readable window) then
 * renames over the target. A crash mid-write leaves the temp file, never a
 * truncated/corrupt key file that would be silently discarded on next read.
 *
 * The parent directory is created 0o700 so a directory listing does not leak
 * which providers are configured.
 */
export declare function encryptToFile(plaintext: string, machineId: string, filePath: string): Promise<void>;
/**
 * Read and decrypt a file written by encryptToFile.
 * Throws if the file is missing, corrupt, or auth-tag check fails.
 */
export declare function decryptFromFile(machineId: string, filePath: string): Promise<string>;
//# sourceMappingURL=key-crypto.d.ts.map