/**
 * AES-256-GCM encryption module for the MCP token store.
 *
 * Wire format (Go-compatible):
 *   [ nonce (12 bytes) ][ ciphertext (N bytes) ][ auth tag (16 bytes) ]
 *
 * This layout is byte-compatible with the Go implementation in
 * padua-mcp/internal/store/encrypt.go.
 */
import type { Encryptor } from './types.js';
type NonceSource = (size: number) => Buffer;
/**
 * Create an AES-256-GCM encryptor from a 64-character hex key (32 bytes).
 *
 * @param hexKey       - 64 hex-character string representing the 32-byte AES key.
 * @param _nonceSource - @internal — injectable nonce source for deterministic testing only.
 *                       Must not be set in production code.
 * @throws StoreError(ENCRYPTION_KEY_UNAVAILABLE) when the key is invalid.
 */
export declare function createEncryptor(hexKey: string, _nonceSource?: NonceSource): Encryptor;
export {};
//# sourceMappingURL=encrypt.d.ts.map