@hiprax/crypto/dist/crypto-manager.d.ts

High-security encryption/decryption library using AES-256-GCM and Argon2id

import type { CryptoManagerOptions, EncryptionParameters, EncryptionResult } from './types.js';
import { SecurityLevel } from './types.js';
/**
 * High-security encryption manager using AES-256-GCM and Argon2id
 * Implements industry-standard cryptographic practices with improved security
 */
export declare class CryptoManager {
    private readonly algorithm;
    private readonly keyLength;
    private readonly ivLength;
    private readonly saltLength;
    private readonly tagLength;
    private readonly argon2Options;
    private readonly aad;
    private readonly defaultPassphrase?;
    constructor(options?: CryptoManagerOptions);
    /**
     * Generate cryptographically secure random bytes
     * @param length - Number of bytes to generate
     * @returns Random bytes
     * @throws CryptoError if length is invalid
     */
    generateSecureRandom(length: number): Buffer;
    /**
     * Derive encryption key from password using Argon2id
     * @param password - User password
     * @param salt - Random salt
     * @returns Derived key
     * @throws CryptoError if derivation fails
     */
    deriveKey(password: string, salt: Buffer): Promise<Buffer>;
    /**
     * Derive encryption key from password using PBKDF2 (synchronous alternative to Argon2id)
     * @param password - User password
     * @param salt - Random salt
     * @returns Derived key
     * @throws CryptoError if derivation fails
     */
    deriveKeySync(password: string, salt: Buffer): Buffer;
    /**
     * Encrypt data using AES-256-GCM
     * @param data - Data to encrypt
     * @param key - Encryption key
     * @param iv - Initialization vector
     * @returns Encrypted data with auth tag
     * @throws CryptoError if encryption fails
     */
    encryptData(data: Buffer, key: Buffer, iv: Buffer): EncryptionResult;
    /**
     * Decrypt data using AES-256-GCM
     * @param encryptedData - Encrypted data
     * @param key - Decryption key
     * @param iv - Initialization vector
     * @param tag - Authentication tag
     * @returns Decrypted data
     * @throws CryptoError if decryption fails
     */
    decryptData(encryptedData: Buffer, key: Buffer, iv: Buffer, tag: Buffer): Buffer;
    /**
     * Encrypt text with password
     * @param text - Text to encrypt
     * @param password - Encryption password (optional if default passphrase is set)
     * @returns Base64 encoded encrypted data
     * @throws CryptoError if encryption fails
     */
    encryptText(text: string, password?: string): Promise<string>;
    /**
     * Decrypt text with password
     * @param encryptedText - Base64 encoded encrypted text
     * @param password - Decryption password (optional if default passphrase is set)
     * @returns Decrypted text
     * @throws CryptoError if decryption fails
     */
    decryptText(encryptedText: string, password?: string): Promise<string>;
    /**
     * Encrypt text with password (synchronous version)
     * @param text - Text to encrypt
     * @param password - Encryption password (optional if default passphrase is set)
     * @returns Base64 encoded encrypted data
     * @throws CryptoError if encryption fails
     */
    encryptTextSync(text: string, password?: string): string;
    /**
     * Decrypt text with password (synchronous version)
     * @param encryptedText - Base64 encoded encrypted text
     * @param password - Decryption password (optional if default passphrase is set)
     * @returns Decrypted text
     * @throws CryptoError if decryption fails
     */
    decryptTextSync(encryptedText: string, password?: string): string;
    /**
     * Encrypt file with password (streaming for large files)
     * @param inputPath - Input file path
     * @param outputPath - Output file path
     * @param password - Encryption password (optional if default passphrase is set)
     * @throws CryptoError if encryption fails
     */
    encryptFile(inputPath: string, outputPath: string, password?: string): Promise<void>;
    /**
     * Decrypt file with password (streaming for large files)
     * @param inputPath - Input file path
     * @param outputPath - Output file path
     * @param password - Decryption password (optional if default passphrase is set)
     * @throws CryptoError if decryption fails
     */
    decryptFile(inputPath: string, outputPath: string, password?: string): Promise<void>;
    /**
     * Encrypt file with password (synchronous version)
     * @param inputPath - Input file path
     * @param outputPath - Output file path
     * @param password - Encryption password (optional if default passphrase is set)
     * @throws CryptoError if encryption fails
     */
    encryptFileSync(inputPath: string, outputPath: string, password?: string): void;
    /**
     * Decrypt file with password (synchronous version)
     * @param inputPath - Input file path
     * @param outputPath - Output file path
     * @param password - Decryption password (optional if default passphrase is set)
     * @throws CryptoError if decryption fails
     */
    decryptFileSync(inputPath: string, outputPath: string, password?: string): void;
    /**
     * Securely clear sensitive data from memory
     * @param buffer - Buffer to clear
     */
    secureClear(buffer: Buffer): void;
    /**
     * Validate password strength
     * @param password - Password to validate
     * @returns True if password meets requirements
     */
    validatePassword(password: string): boolean;
    /**
     * Get encryption parameters for debugging/info
     * @returns Current encryption parameters
     */
    getParameters(): EncryptionParameters;
    /**
     * Get security level based on current configuration
     * @returns Security level
     */
    getSecurityLevel(): SecurityLevel;
    /**
     * Check if a default passphrase is set
     * @returns True if default passphrase is configured
     */
    hasDefaultPassphrase(): boolean;
}
//# sourceMappingURL=crypto-manager.d.ts.map