/**
 * Encrypt a value for storage. Returns the original value unchanged when no
 * encryption key is configured (development convenience). Production deployments
 * MUST set `CMS_ENCRYPTION_KEY` — see `security.mdc`.
 */
export declare function encryptSecret(plaintext: string): Promise<string>;
/**
 * Decrypt a value that was stored via `encryptSecret`. Plaintext values
 * (written before encryption was enabled, or written by a deployment without
 * the key) are returned unchanged.
 */
export declare function decryptSecret(stored: string): Promise<string>;
/** True when the value is stored encrypted (and therefore needs decryption). */
export declare function isEncrypted(value: string): boolean;
/**
 * Encrypt each string element in an array. Returns the array unchanged when
 * encryption is disabled. Used for things like TOTP backup codes.
 */
export declare function encryptStringArray(values: string[]): Promise<string[]>;
/** Decrypt each element in an array stored via `encryptStringArray`. */
export declare function decryptStringArray(values: string[]): Promise<string[]>;
//# sourceMappingURL=secret-storage.d.ts.map