/**
 * Set the encryption key for OAuth token storage.
 * Called during OAuth initialization from start.ts.
 */
export declare function setEncryptionKey(keyHex: string): void;
/**
 * Get the encryption key. Reads from explicit config first,
 * then falls back to OAUTH_ENCRYPTION_KEY env var.
 */
export declare function getEncryptionKey(): Buffer;
/**
 * Encrypt a plaintext string with AES-256-GCM.
 * Returns base64-encoded string: iv:ciphertext:tag
 */
export declare function encrypt(plaintext: string): string;
/**
 * Decrypt a base64-encoded AES-256-GCM ciphertext.
 */
export declare function decrypt(encoded: string): string;