/**
 * Encrypt a string. A fresh random IV is generated per call and prepended to
 * the ciphertext ("ivHex:cipherHex") so identical plaintexts no longer produce
 * identical ciphertexts.
 * @param text The text to encrypt
 * @returns The encrypted text
 */
export declare function encrypt(text: string): string;
/**
 * Decrypt an encrypted string. Handles both the current format ("ivHex:cipher")
 * and the legacy format (ciphertext only, encrypted with the static IV).
 * @param encryptedText The encrypted text
 * @returns The decrypted text
 */
export declare function decrypt(encryptedText: string): string;
/**
 * Returns the server's RSA public key in PEM (SPKI) format.
 * Expose this via a GET endpoint so clients can encrypt before sending.
 */
export declare function getRSAPublicKey(): string;
/**
 * Hybrid-encrypted payload sent by the client.
 * - encryptedKey : RSA-OAEP encrypted 256-bit AES key (base64)
 * - iv           : 12-byte AES-GCM IV (base64)
 * - data         : AES-256-GCM ciphertext + 16-byte auth-tag (base64)
 */
export interface EncryptedPayload {
    encryptedKey: string;
    iv: string;
    data: string;
}
/**
 * Decrypts a hybrid-encrypted payload produced by the client.
 * 1. Unwraps the AES key with RSA-OAEP (SHA-256)
 * 2. Decrypts the data with AES-256-GCM
 */
export declare function decryptTransitPayload(payload: EncryptedPayload): string;