import type { FormField } from './types.js';
/** Whether a field's stored value should be encrypted at rest. */
export declare function fieldShouldEncrypt(field: FormField): boolean;
/**
 * Encrypt the sensitive values in a submission data record. Returns a new
 * object; non-sensitive keys are copied through unchanged. Also returns the set
 * of keys that were encrypted (useful for masking decisions / auditing).
 */
export declare function encryptSubmissionData(fields: FormField[], data: Record<string, unknown>): Promise<{
    data: Record<string, unknown>;
    encryptedKeys: string[];
}>;
/**
 * Decrypt any encrypted values in a stored submission data record. Operates on
 * the `enc:v1:` prefix, so it is safe to call on records that were never
 * encrypted (plaintext passes through). Throws only if a value is encrypted but
 * `CMS_ENCRYPTION_KEY` is missing — fail-closed, never silently leak ciphertext.
 */
export declare function decryptSubmissionData(data: Record<string, unknown> | null | undefined): Promise<Record<string, unknown> | null>;
//# sourceMappingURL=encryption.d.ts.map