/**
 * Session Crypto - Encrypts and decrypts session data at rest
 *
 * Uses AES-256-GCM for authenticated encryption with:
 * - PBKDF2 key derivation from user-supplied password
 * - Random IV for each encryption
 * - Authentication tag for integrity verification
 *
 * Environment variable: LLM_BROWSER_SESSION_KEY
 * - If set, sessions are encrypted before saving and decrypted on load
 * - If not set, sessions are stored in plaintext (backward compatible)
 */
/**
 * Session crypto manager
 * Handles encryption/decryption of session data using AES-256-GCM
 */
export declare class SessionCrypto {
    private key;
    private salt;
    constructor();
    /**
     * Check if encryption is enabled (key is set)
     */
    isEnabled(): boolean;
    /**
     * Get the environment variable name for the encryption key
     */
    getEnvVarName(): string;
    /**
     * Initialize encryption key from environment variable
     */
    private initializeFromEnv;
    /**
     * Derive encryption key from password using PBKDF2
     */
    private deriveKey;
    /**
     * Encrypt plaintext data
     * Returns encrypted payload as JSON string, or original if encryption disabled
     */
    encrypt(plaintext: string): string;
    /**
     * Decrypt encrypted data
     * Returns decrypted plaintext, or original if not encrypted
     */
    decrypt(data: string): string;
    /**
     * Check if data appears to be encrypted
     */
    isEncrypted(data: string): boolean;
    /**
     * Re-encrypt data with a new key (for key rotation)
     * Decrypts with current key, re-encrypts with new key
     */
    reencrypt(data: string, newPassword: string): string;
}
/**
 * Singleton instance for global use
 */
export declare const sessionCrypto: SessionCrypto;
//# sourceMappingURL=session-crypto.d.ts.map