/**
 * Get or create the encryption key for OAuth token files.
 * Priority: AGENCY_OAUTH_KEY env var > system keyring > null (plaintext fallback)
 */
export declare function getEncryptionKey(): Promise<Buffer | null>;
/**
 * Encrypt a string using AES-256-GCM.
 * Returns a base64-encoded string: iv (12 bytes) + auth tag (16 bytes) + ciphertext
 */
export declare function encrypt(plaintext: string, key: Buffer): string;
/**
 * Decrypt a base64-encoded string produced by encrypt().
 * Layout: iv (12 bytes) + auth tag (16 bytes) + ciphertext
 */
export declare function decrypt(ciphertext: string, key: Buffer): string;