/**
 * Cryptographic utilities for secure credential storage
 *
 * Security Model:
 * - API Keys: Hashed with SHA-256 (one-way, server compares hashes)
 * - Vendor Keys: Encrypted with AES-256-GCM (reversible, needed for API headers)
 * - Encryption key derived from machine-specific identifier + user password (optional)
 */
/**
 * Encrypted data structure
 */
export interface EncryptedData {
    encrypted: string;
    iv: string;
    authTag: string;
    salt: string;
    version: string;
}
/**
 * Encrypt sensitive data (like vendor keys)
 *
 * @param data - The sensitive data to encrypt
 * @param passphrase - Optional user passphrase for additional security
 * @returns Encrypted data structure
 */
export declare function encryptCredential(data: string, passphrase?: string): EncryptedData;
/**
 * Decrypt sensitive data
 *
 * @param encryptedData - The encrypted data structure
 * @param passphrase - Optional user passphrase (must match encryption)
 * @returns Decrypted data
 */
export declare function decryptCredential(encryptedData: EncryptedData, passphrase?: string): string;
/**
 * Secure vendor key storage wrapper
 */
export interface SecureVendorKey {
    keyHash: string;
    encryptedKey: EncryptedData;
    createdAt: string;
    lastUsed?: string;
    encrypted: true;
}
/**
 * Securely store a vendor key
 *
 * @param vendorKey - The raw vendor key
 * @param passphrase - Optional user passphrase for additional security
 * @returns Secure storage structure
 */
export declare function secureStoreVendorKey(vendorKey: string, passphrase?: string): SecureVendorKey;
/**
 * Retrieve a vendor key from secure storage
 *
 * @param secureKey - The secure storage structure
 * @param passphrase - Optional user passphrase (must match storage)
 * @returns Decrypted vendor key
 */
export declare function retrieveVendorKey(secureKey: SecureVendorKey, passphrase?: string): string;
/**
 * Validate a vendor key against stored hash
 *
 * @param vendorKey - The key to validate
 * @param storedHash - The stored hash to compare against
 * @returns True if key matches hash
 */
export declare function validateVendorKeyHash(vendorKey: string, storedHash: string): boolean;
/**
 * Check if a value is encrypted vendor key data
 */
export declare function isEncryptedVendorKey(value: any): value is SecureVendorKey;
/**
 * Migration helper: Check if vendor key needs encryption upgrade
 */
export declare function needsEncryptionMigration(vendorKey: any): boolean;