declare const PREFIX = "enc:v1:";
export type EncryptedField = `${typeof PREFIX}${string}`;
export declare function isEncrypted(value: string): value is EncryptedField;
/**
 * Imports a base64-encoded 32-byte key as an AES-256-GCM CryptoKey. Throws if
 * the decoded key is not exactly 32 bytes so a misconfigured secret fails loudly
 * at boot rather than silently weakening encryption.
 */
export declare function loadEncryptionKey(b64: string): Promise<CryptoKey>;
/**
 * Encrypts a string with AES-256-GCM using a fresh random IV. The output is
 * `enc:v1:<base64url(iv ‖ ciphertext ‖ tag)>`.
 */
export declare function encryptField(plaintext: string, key: CryptoKey): Promise<EncryptedField>;
/**
 * Decrypts a value produced by `encryptField`. Values without the `enc:v1:`
 * prefix are assumed to be legacy plaintext and returned unchanged. Throws if a
 * prefixed value cannot be decrypted (wrong key or corrupted ciphertext).
 */
export declare function decryptField(value: string, key: CryptoKey): Promise<string>;
export {};
