/**
 * Encrypt arbitrary string. Returns a self-describing token of the form
 * `mc1:<iv>:<tag>:<ciphertext>`. Empty string → empty string (allows
 * "remove credential" semantics without special-casing callers).
 */
export declare function encrypt(plaintext: string): string;
/**
 * Decrypt a token produced by `encrypt`. Throws if the token is corrupt,
 * tampered with, or encrypted under a different master key. Never returns
 * partial / garbage data — that's the GCM tag's job.
 */
export declare function decrypt(token: string): string;
/** Heuristic: "is this string an encrypted token of ours?" Used by migration code. */
export declare function isEncrypted(s: string): boolean;
/** Constant-time string compare. Use when matching webhook signatures or HMAC tags. */
export declare function safeEqual(a: string, b: string): boolean;
/**
 * Diagnostic: returns the master key fingerprint (first 8 hex chars of
 * SHA-256 of the key). Lets the customer verify backup integrity without
 * exposing the key itself.
 */
export declare function masterKeyFingerprint(): string;
//# sourceMappingURL=cred-store.d.ts.map