/**
 * Log encryption utilities for Neotoma
 *
 * Encrypts individual log lines (JSONL format) with AES-256-GCM using the
 * Log Key derived from the user's private key or mnemonic.
 *
 * Format: each line is iv:authTag:ciphertext (hex), one per line.
 *
 * Design decisions:
 * - Per-entry IV ensures unique ciphertext per line
 * - No global file key; each line is independently decryptable
 * - Works with log rotation (each file is a sequence of encrypted lines)
 */
/**
 * Load the log encryption key from config.
 * Returns null if log encryption is not enabled.
 */
export declare function getLogKey(): Uint8Array | null;
/**
 * Clear the cached log key (for testing or key rotation).
 */
export declare function clearCachedLogKey(): void;
/**
 * Encrypt a single log line for persistent storage.
 *
 * @param plaintext - The JSON log line to encrypt
 * @param key - 32-byte AES-256 key (Log Key)
 * @returns Encrypted string in iv:authTag:ciphertext format
 */
export declare function encryptLogLine(plaintext: string, key: Uint8Array): string;
/**
 * Decrypt a single encrypted log line.
 *
 * @param encrypted - Encrypted line in iv:authTag:ciphertext format
 * @param key - 32-byte AES-256 key (same Log Key used for encryption)
 * @returns Decrypted plaintext string
 */
export declare function decryptLogLine(encrypted: string, key: Uint8Array): string;
/**
 * Check if a line looks like an encrypted log line.
 */
export declare function isEncryptedLogLine(line: string): boolean;
//# sourceMappingURL=log_encrypt.d.ts.map