/**
 * OAuth Token Encryption Service
 *
 * Provides AES-256-GCM encryption for OAuth access/refresh tokens.
 * Uses Web Crypto API for secure, standards-compliant encryption.
 *
 * Security features:
 * - AES-256-GCM authenticated encryption
 * - Random IV (Initialization Vector) per encryption
 * - Key versioning for rotation support
 * - Base64 encoding for database storage
 *
 * @see https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto
 */
import { EncryptedToken } from './types';
/**
 * Token Encryption Service
 */
export declare class TokenEncryption {
    private static cachedKey;
    private static currentKeyId;
    /**
     * Get or create the encryption key from environment variable
     */
    private static getEncryptionKey;
    /**
     * Generate a new encryption key (for initial setup or rotation)
     * Returns a base64-encoded key suitable for environment variables
     */
    static generateKey(): Promise<string>;
    /**
     * Encrypt an OAuth token
     *
     * @param token - The plain text token to encrypt
     * @returns Encrypted token data with IV and key ID
     */
    static encrypt(token: string): Promise<EncryptedToken>;
    /**
     * Decrypt an OAuth token
     *
     * @param encrypted - Base64-encoded encrypted data
     * @param iv - Base64-encoded initialization vector
     * @param keyId - Encryption key version ID
     * @returns Decrypted plain text token
     */
    static decrypt(encrypted: string, iv: string, keyId: string): Promise<string>;
    /**
     * Encrypt both access and refresh tokens
     *
     * @param accessToken - OAuth access token
     * @param refreshToken - OAuth refresh token (optional)
     * @returns Encrypted token pair
     */
    static encryptTokenPair(accessToken: string, refreshToken?: string): Promise<{
        encryptedAccessToken: EncryptedToken;
        encryptedRefreshToken?: EncryptedToken;
    }>;
    /**
     * Decrypt both access and refresh tokens
     *
     * @param encryptedAccessToken - Encrypted access token data
     * @param encryptedRefreshToken - Encrypted refresh token data (optional)
     * @returns Decrypted token pair
     */
    static decryptTokenPair(encryptedAccessToken: EncryptedToken, encryptedRefreshToken?: EncryptedToken): Promise<{
        accessToken: string;
        refreshToken?: string;
    }>;
    /**
     * Rotate encryption keys
     * This would be called during a key rotation process
     *
     * @param newKeyId - New key version ID
     * @param newKey - New encryption key (base64-encoded)
     */
    static rotateKey(newKeyId: string, newKey: string): Promise<void>;
    /**
     * Helper: Convert ArrayBuffer to Base64
     */
    private static bufferToBase64;
    /**
     * Helper: Convert Base64 to ArrayBuffer
     */
    private static base64ToBuffer;
    /**
     * Clear cached encryption key (for testing or key rotation)
     */
    static clearCache(): void;
}
//# sourceMappingURL=encryption.d.ts.map