/** 02-store §4 */
export declare function validateEncryptionKey(value: string): Buffer;
/** 02-store §4 — envelope version `v2`: AES-256-GCM with the secret NAME
 *  bound as AAD, so a ciphertext swapped between rows (or served for the
 *  wrong name) fails the auth tag instead of decrypting to another secret's
 *  value. */
export declare function encryptSecret(value: string, key: Buffer, name: string): string;
/** 02-store §4 */
export declare function decryptSecret(value: string, key: Buffer, name: string): string;
//# sourceMappingURL=crypto.d.ts.map