import type { KeyProvider } from './key-provider.js';
import type { EncryptedFieldMarker, EncryptionConfig, EncryptOptions, DecryptOptions, ReencryptOptions, FieldEncryptionPolicy, AuditCallback } from './types.js';
/**
 * Custom error class for encryption operations
 */
export declare class FieldEncryptionError extends Error {
    readonly code: string;
    readonly details?: Record<string, unknown>;
    constructor(message: string, code: string, details?: Record<string, unknown>);
}
/**
 * Field-level encryption service
 *
 * Provides methods for encrypting and decrypting individual fields
 * with support for key versioning, AAD binding, and audit logging.
 *
 * @example
 * ```typescript
 * const service = createFieldEncryptionService();
 * await service.initialize();
 *
 * // Encrypt a sensitive field
 * const encrypted = await service.encrypt('123-45-6789', {
 *   fieldName: 'ssn',
 *   classification: DataClassification.RESTRICTED,
 * });
 *
 * // Decrypt the field
 * const plaintext = await service.decrypt(encrypted, {
 *   fieldName: 'ssn',
 * });
 * ```
 */
export declare class FieldEncryptionService {
    private readonly config;
    private readonly keyProvider;
    private readonly auditCallbacks;
    private initialized;
    constructor(config?: Partial<EncryptionConfig>, keyProvider?: KeyProvider);
    /**
     * Initialize the encryption service
     */
    initialize(): Promise<void>;
    /**
     * Ensure the service is initialized
     */
    private ensureInitialized;
    /**
     * Register an audit callback
     */
    onAudit(callback: AuditCallback): void;
    /**
     * Emit audit event
     */
    private emitAudit;
    /**
     * Check if encryption is required for the given classification
     */
    private requiresEncryption;
    /**
     * Build Additional Authenticated Data (AAD)
     */
    private buildAAD;
    /**
     * Encrypt a plaintext value
     *
     * @param plaintext - The value to encrypt
     * @param options - Encryption options
     * @returns Encrypted field marker ready for storage
     */
    encrypt(plaintext: string, options?: EncryptOptions): Promise<EncryptedFieldMarker>;
    /**
     * Decrypt an encrypted field
     *
     * @param encryptedMarker - The encrypted field marker
     * @param options - Decryption options
     * @returns Decrypted plaintext
     */
    decrypt(encryptedMarker: EncryptedFieldMarker, options?: DecryptOptions): Promise<string>;
    /**
     * Encrypt multiple fields in an object according to a policy
     *
     * @param obj - The object containing fields to encrypt
     * @param policy - The encryption policy defining which fields to encrypt
     * @param tenantId - Optional tenant ID for multi-tenant isolation
     * @returns Object with encrypted fields
     */
    encryptObject<T extends Record<string, unknown>>(obj: T, policy: FieldEncryptionPolicy, tenantId?: string): Promise<T>;
    /**
     * Decrypt multiple fields in an object according to a policy
     *
     * @param obj - The object containing encrypted fields
     * @param policy - The encryption policy defining which fields to decrypt
     * @param tenantId - Optional tenant ID for multi-tenant isolation
     * @returns Object with decrypted fields
     */
    decryptObject<T extends Record<string, unknown>>(obj: T, policy: FieldEncryptionPolicy, tenantId?: string): Promise<T>;
    /**
     * Re-encrypt a field with a new key version
     *
     * @param encryptedMarker - The currently encrypted field
     * @param options - Re-encryption options including new key version
     * @returns Newly encrypted field marker
     */
    reencrypt(encryptedMarker: EncryptedFieldMarker, options: ReencryptOptions): Promise<EncryptedFieldMarker>;
    /**
     * Get the current key version
     */
    getCurrentKeyVersion(): Promise<number>;
    /**
     * Get nested value from object using dot notation
     */
    private getNestedValue;
    /**
     * Set nested value in object using dot notation
     */
    private setNestedValue;
    /**
     * Shutdown the service
     */
    shutdown(): Promise<void>;
}
/**
 * Create a new FieldEncryptionService instance
 */
export declare function createFieldEncryptionService(config?: Partial<EncryptionConfig>, keyProvider?: KeyProvider): FieldEncryptionService;
/**
 * Get the default field encryption service instance
 */
export declare function getFieldEncryptionService(): FieldEncryptionService;
/**
 * Set a custom field encryption service as the default
 */
export declare function setFieldEncryptionService(service: FieldEncryptionService): void;
/**
 * Reset the default field encryption service (for testing)
 */
export declare function resetFieldEncryptionService(): Promise<void>;
//# sourceMappingURL=service.d.ts.map