import type * as KeetaNetClient from '@keetanetwork/keetanet-client';
import { type CertificateAttributeValueMap, type CertificateAttributeValue } from '../../services/kyc/iso20022.generated.js';
import type { CertificateBuilder, Certificate } from '../certificates.js';
import { SensitiveAttribute } from '../certificates.js';
import { KeetaAnchorError } from '../error.js';
type AccountKeyAlgorithm = InstanceType<typeof KeetaNetClient.lib.Account>['keyType'];
type KeetaNetAccount = ReturnType<typeof KeetaNetClient.lib.Account.fromSeed<AccountKeyAlgorithm>>;
/**
 * Type alias for certificate attribute names
 */
export type PIIAttributeNames = keyof CertificateAttributeValueMap;
/**
 * PII error codes
 */
export type PIIErrorCode = 'PII_ATTRIBUTE_NOT_FOUND' | 'PII_EXTERNAL_ATTRIBUTE';
/**
 * Error class for PII-related errors
 */
export declare class PIIError extends KeetaAnchorError {
    static readonly name: string;
    private readonly PIIErrorObjectTypeID;
    private static readonly PIIErrorObjectTypeID;
    readonly code: PIIErrorCode;
    readonly attributeName: string;
    constructor(code: PIIErrorCode, attributeName: string, message: string);
    static isInstance(input: unknown, code?: PIIErrorCode): input is PIIError;
}
/**
 * PIIStore is a secure container for Personally Identifiable Information (PII).
 *
 * It encapsulates sensitive data and prevents accidental logging or serialization
 * by overriding common output methods to return redacted placeholders.
 *
 * @example
 * ```typescript
 * const store = new PIIStore();
 * store.setAttribute('firstName', 'John');
 * store.setAttribute('lastName', 'Doe');
 *
 * console.log(store); // '[PIIStore: REDACTED]'
 * JSON.stringify(store); // '{"type":"PIIStore","message":"REDACTED"}'
 * ```
 */
export declare class PIIStore {
    #private;
    constructor();
    /**
     * Create a PIIStore from a Certificate, extracting all attributes
     *
     * @param certificate - The certificate to extract attributes from
     *
     * @returns A new PIIStore populated with the certificate's attributes
     */
    static fromCertificate(certificate: Certificate): PIIStore;
    /**
     * Set a known certificate attribute
     *
     * @param name - The attribute name
     * @param value - The value to store
     * @param sensitive - Whether the attribute is sensitive (default: true)
     */
    setAttribute<K extends PIIAttributeNames>(name: K, value: CertificateAttributeValue<K>, sensitive?: boolean): void;
    setAttribute<T>(name: string, value: T, sensitive?: boolean): void;
    /**
     * Check if an attribute exists in the store
     */
    hasAttribute(name: string): boolean;
    /**
     * Get all attribute names currently stored
     */
    getAttributeNames(): string[];
    /**
     * Execute a function with scoped access to PII values
     *
     * Provides controlled access to all attribute values. Known certificate attributes
     * are automatically typed; external attributes require an explicit type parameter.
     *
     * @param fn - Function that receives a getter for accessing attribute values
     * @returns The return value of the callback function
     *
     * @throws PIIError with PII_ATTRIBUTE_NOT_FOUND if accessing a missing attribute
     */
    run<R>(fn: (get: {
        <K extends PIIAttributeNames>(name: K): CertificateAttributeValue<K>;
        <T>(name: string): T;
    }) => R): R;
    /**
     * Create a SensitiveAttribute for a known certificate attribute
     *
     * Only known certificate attributes are supported. External attributes
     * cannot be converted to SensitiveAttributes.
     *
     * @param name - The attribute name to convert (must be a known certificate attribute)
     * @param subjectKey - The account to encrypt the attribute for
     * @returns A SensitiveAttribute containing the encrypted value
     *
     * @throws PIIError with PII_ATTRIBUTE_NOT_FOUND if the attribute is not set
     * @throws Error if the attribute is not a known certificate attribute
     */
    toSensitiveAttribute<K extends PIIAttributeNames>(name: K, subjectKey: KeetaNetAccount): Promise<SensitiveAttribute<CertificateAttributeValue<K>>>;
    /**
     * Apply known attributes to a CertificateBuilder
     *
     * External attributes are not included in the certificate.
     *
     * @param builder - The certificate builder to apply attributes to
     * @param subjectKey - The subject's account key (required to encrypt sensitive attributes)
     * @returns The certificate builder with the attributes applied
     */
    toCertificateBuilder(builder: CertificateBuilder, subjectKey: KeetaNetAccount): Promise<CertificateBuilder>;
    /**
     * Prevent logging of PII data via string coercion
     */
    toString(): string;
    /**
     * Serialize to JSON with redacted values
     *
     * Shows attribute names for debugging, but all values are redacted.
     */
    toJSON(): {
        type: string;
        attributes: {
            [key: string]: string;
        };
    };
}
export {};
//# sourceMappingURL=pii.d.ts.map