/**
 * Cryptographic Utilities for Wallet Session Security
 *
 * AES-256-GCM encryption for viewing keys at rest.
 * SHA-256 hashing for viewing key lookup/deduplication.
 *
 * Uses Node.js built-in crypto module, zero additional dependencies.
 */
/**
 * Derive the 32-byte encryption key from environment or fallback.
 *
 * Production: Set ENCRYPTION_KEY environment variable.
 * Development: Falls back to a process-scoped key (keys lost on restart, acceptable for dev).
 */
export declare function getEncryptionKey(): Buffer;
/**
 * Encrypt plaintext using AES-256-GCM.
 * Returns combined format: base64(iv):base64(authTag):base64(ciphertext)
 */
export declare function encrypt(plaintext: string, key: Buffer): string;
/**
 * Decrypt a combined string back to plaintext.
 * Throws on authentication failure (tampered ciphertext or wrong key).
 */
export declare function decrypt(combined: string, key: Buffer): string;
/**
 * SHA-256 hash of a viewing key for lookup/dedup purposes.
 * Returns 64-character hex string.
 */
export declare function hashViewingKey(viewingKey: string): string;
