/**
 * Thrown for invalid `CMS_ENCRYPTION_KEY` shape. We use a named class so the
 * caller (typically an API handler) can map it to a clear 500 with operator
 * guidance rather than the opaque `OperationError` that some Web Crypto
 * implementations throw on malformed keys.
 */
export declare class InvalidEncryptionKeyError extends Error {
    constructor(reason: string);
}
/** Encrypt a field value using AES-256-GCM. */
export declare function encryptField(value: string, keyHex: string): Promise<string>;
/** Decrypt a field value encrypted with AES-256-GCM. */
export declare function decryptField(encrypted: string, keyHex: string): Promise<string>;
//# sourceMappingURL=encrypted-fields.d.ts.map