/**
 * Validate encryption secret meets minimum requirements
 *
 * @param secret - Secret to validate
 * @throws Error if secret is invalid
 */
export declare function validateEncryptionSecret(secret: string): void;
/**
 * Encrypt a token using AES-256-GCM
 *
 * Uses Galois/Counter Mode (GCM) which provides both confidentiality
 * and authenticity (prevents tampering).
 *
 * Format: iv:authTag:encryptedData (all hex-encoded)
 *
 * @param token - Plain text token to encrypt
 * @param secret - Encryption secret (at least 32 characters)
 * @returns Encrypted token with IV and auth tag
 */
export declare function encryptToken(token: string, secret: string): string;
/**
 * Decrypt a token using AES-256-GCM
 *
 * Validates the auth tag to ensure the data hasn't been tampered with.
 *
 * @param encryptedToken - Encrypted token from encryptToken()
 * @param secret - Encryption secret used during encryption
 * @returns Decrypted plain text token
 * @throws Error if decryption fails or auth tag is invalid
 */
export declare function decryptToken(encryptedToken: string, secret: string): string;
//# sourceMappingURL=encryption-utils.d.ts.map