/**
 * Envelope encryption for TOTP secrets using AES-256-GCM.
 *
 * - Derives a 32-byte key via SHA-256 from `MFA_ENCRYPTION_KEY` or `JWT_SECRET`.
 * - Generates a random 12-byte IV per encryption call.
 * - Returns ciphertexts in the format `iv_hex:authTag_hex:ciphertext_hex`.
 *
 * @module
 */
/**
 * Encrypt a plaintext TOTP secret.
 *
 * @param plaintext - The Base32 TOTP secret to encrypt.
 * @returns A string in the format `iv_hex:authTag_hex:ciphertext_hex`.
 */
export declare function encryptTotpSecret(plaintext: string): string;
/**
 * Decrypt a previously encrypted TOTP secret.
 *
 * @param ciphertext - A string in the format `iv_hex:authTag_hex:ciphertext_hex`.
 * @returns The original Base32 TOTP secret.
 */
export declare function decryptTotpSecret(ciphertext: string): string;