import type { Host } from "../host/host.js";
/**
 * Get or create the encryption key for OAuth token files.
 * Priority: AGENCY_OAUTH_KEY env var > system keyring > null (plaintext fallback)
 * The keyring is reached through `host`, the run's host.
 */
export declare function getEncryptionKey(host: Host): Promise<Buffer | null>;
/**
 * Encrypt a string using AES-256-GCM.
 * Returns a base64-encoded string: iv (12 bytes) + auth tag (16 bytes) + ciphertext
 */
export declare function encrypt(plaintext: string, key: Buffer): string;
/**
 * Decrypt a base64-encoded string produced by encrypt().
 * Layout: iv (12 bytes) + auth tag (16 bytes) + ciphertext
 */
export declare function decrypt(ciphertext: string, key: Buffer): string;