/** Parse an `iv:data` sealed slot (split on the FIRST `:`). */
export declare function parseSealedSlot(blob: string): {
    iv: string;
    data: string;
};
/**
 * Dual-read: decrypt a sealed slot trying the CEK-derived field key first,
 * falling back to the collection-DEK field key. Legacy records
 * (even ones whose body is CEK-encrypted) are sealed under the collection-DEK
 * key; current writes seal under the per-record CEK. Try the CEK key first; on
 * its AES-GCM auth failure, fall back to the DEK key. Throws only if BOTH fail.
 * Returns the plaintext string (callers `JSON.parse` as needed).
 */
export declare function dualReadSealedSlot(blob: string, field: string, collection: string, cek: CryptoKey | undefined, dek: CryptoKey): Promise<string>;