/**
 * Token Encryption Utilities
 *
 * Provides AES-256-GCM encryption and decryption for OAuth tokens
 * stored in the database.
 */
/**
 * Encrypt a token using AES-256-GCM
 *
 * The encrypted output format is: salt:iv:authTag:encryptedData (all hex-encoded)
 *
 * @param token - Plain text token to encrypt
 * @param secret - Encryption secret (client secret or custom encryption key)
 * @returns Encrypted token string (format: salt:iv:authTag:encryptedData)
 * @throws Error if encryption fails
 */
export declare function encryptToken(token: string, secret: string): string;
/**
 * Decrypt a token using AES-256-GCM
 *
 * @param encryptedToken - Encrypted token string (format: salt:iv:authTag:encryptedData)
 * @param secret - Decryption secret (must match encryption secret)
 * @returns Decrypted plain text token
 * @throws Error if decryption fails or token is tampered
 */
export declare function decryptToken(encryptedToken: string, secret: string): string;
/**
 * Validate that encryption secret meets security requirements
 *
 * @param secret - Secret to validate
 * @returns true if valid
 * @throws Error if invalid
 */
export declare function validateEncryptionSecret(secret: string): boolean;