export type EncBlob = {
    alg: 'A256GCM';
    kid: string;
    iv: string;
    tag: string;
    data: string;
    exp?: number;
    meta?: Record<string, unknown>;
};
export type VaultKey = {
    kid: string;
    key: Buffer;
};
export declare class TokenVault {
    /** Active key used for new encryptions */
    private active;
    /** All known keys by kid for decryption (includes active) */
    private keys;
    constructor(keys: VaultKey[]);
    rotateTo(k: VaultKey): void;
    encrypt(plaintext: string, opts?: {
        exp?: number;
        meta?: Record<string, unknown>;
    }): EncBlob;
    decrypt(blob: EncBlob): string;
}