/**
 * Encryption key management for the MCP token store.
 *
 * The AES-256-GCM key is resolved from (in order):
 *   1. PADUA_DB_ENCRYPTION_KEY environment variable
 *   2. ~/.padua/encryption.key file
 *
 * On first login, if neither source exists, a random 32-byte key is generated
 * and persisted to the key file with 0o600 permissions.
 */
/**
 * Resolve an existing encryption key from environment variable or key file.
 * Returns null if no valid key is found.
 */
export declare function resolveEncryptionKey(keyFilePath?: string): string | null;
/**
 * Resolve or generate an encryption key, always persisting to the key file.
 *
 * If a valid key exists (env or file), returns it.
 * Otherwise generates a new 32-byte random key.
 * In all cases, ensures the key file exists on disk so that other commands
 * (status, doctor) can find it without requiring the env var.
 */
export declare function getOrCreateEncryptionKey(keyFilePath?: string): string;
//# sourceMappingURL=key.d.ts.map