import { DataAdapters } from "@authhero/adapter-interfaces";
/**
 * Wraps a DataAdapters instance so that sensitive credential fields are
 * transparently encrypted on write and decrypted on read. Only the adapters
 * that hold secrets are wrapped; everything else passes through unchanged.
 *
 * Encrypted columns: clients.client_secret, connections.options
 * (client_secret/app_secret/twilio_token/configuration.client_secret),
 * email_providers.credentials, authentication_methods.totp_secret,
 * migration_sources.credentials.client_secret.
 *
 * clientConnections.listByClient is also wrapped so its returned Connection
 * objects are decrypted — getEnrichedClient uses this path to load connections
 * for the OAuth strategies.
 *
 * Private keys (keys.pkcs7, dkim_private_key) are intentionally NOT covered.
 */
export declare function createEncryptedDataAdapter(data: DataAdapters, key: CryptoKey): DataAdapters;
