/**
 * Crypto Utilities
 *
 * Provides AES-256-GCM encryption/decryption for token storage at rest.
 * Uses PBKDF2 for key derivation from machine-specific identifiers.
 */
/**
 * Encrypted data structure for storage
 */
export interface EncryptedData {
    /** Base64-encoded 12-byte IV (96 bits for GCM) */
    iv: string;
    /** Base64-encoded 16-byte authentication tag */
    authTag: string;
    /** Base64-encoded ciphertext */
    ciphertext: string;
}
/**
 * Encrypt plaintext using AES-256-GCM
 *
 * @param plaintext - The string to encrypt
 * @param key - 32-byte encryption key
 * @returns Encrypted data with IV, auth tag, and ciphertext
 */
export declare function encrypt(plaintext: string, key: Buffer): EncryptedData;
/**
 * Decrypt data encrypted with AES-256-GCM
 *
 * @param data - Encrypted data structure
 * @param key - 32-byte encryption key (must match encryption key)
 * @returns Decrypted plaintext
 * @throws Error if decryption fails (wrong key, corrupted data, or tampered)
 */
export declare function decrypt(data: EncryptedData, key: Buffer): string;
/**
 * Derive a 256-bit encryption key using PBKDF2
 *
 * @param machineId - Machine identifier string
 * @param salt - Random salt (should be stored alongside encrypted data)
 * @param iterations - PBKDF2 iterations (default: 100000)
 * @returns 32-byte key buffer
 */
export declare function deriveKey(machineId: string, salt: Buffer, iterations?: number): Buffer;
//# sourceMappingURL=crypto.d.ts.map