/**
 * LocalSecretBox
 *
 * Tiny, zero-dependency AES-256-GCM wrapper used to encrypt per-provider
 * cloud API tokens at rest in the local SQLite database.
 *
 * Threat model: local-machine confidentiality. Protects the token against
 * casual filesystem reads (e.g. another logged-in process on the same
 * machine that does not run as the same user). It does NOT protect against
 * a root-level attacker or a backup-theft scenario — those require a
 * higher-level secret store.
 *
 * Spec 089 (one-click-cloud-deploy) research §2.
 */
export declare const LOCAL_SECRET_KEY_BYTES = 32;
export declare const LOCAL_SECRET_IV_BYTES = 12;
export declare const LOCAL_SECRET_TAG_BYTES = 16;
export interface EncryptedBlob {
    ciphertext: Buffer;
    iv: Buffer;
    tag: Buffer;
}
export declare class LocalSecretBox {
    private readonly key;
    constructor(key: Buffer);
    encrypt(plaintext: string): EncryptedBlob;
    decrypt(blob: EncryptedBlob): string;
}
//# sourceMappingURL=local-secret-box.d.ts.map