export declare const RESTRICTED_FRAGMENT_STORAGE_DEFAULT_MODE: "disabled";
export declare const RESTRICTED_FRAGMENT_ENVELOPE_ALGORITHMS: readonly ["AES-256-GCM"];
export declare const RESTRICTED_FRAGMENT_AUDIT_EVENTS: readonly ["restricted_fragment_detected", "restricted_fragment_shadow_recorded", "restricted_fragment_encrypted", "restricted_fragment_decrypt_denied", "restricted_fragment_restore_attempted", "restricted_fragment_ciphertext_deleted", "restricted_fragment_key_destroyed", "restricted_fragment_crypto_shredded", "restricted_fragment_backup_expiry_pending"];
export type RestrictedFragmentStorageMode = typeof RESTRICTED_FRAGMENT_STORAGE_DEFAULT_MODE;
export type RestrictedFragmentEnvelopeAlgorithm = (typeof RESTRICTED_FRAGMENT_ENVELOPE_ALGORITHMS)[number];
export type RestrictedFragmentAuditEventType = (typeof RESTRICTED_FRAGMENT_AUDIT_EVENTS)[number];
export type RestrictedFragmentCategory = "credential" | "password" | "api_key" | "token" | "private_key" | "payment_data" | "regulated_pii" | "sensitive_pii";
export type RestrictedFragmentLifecycleStatus = "shadow_only" | "encrypted" | "delete_requested" | "ciphertext_deleted" | "key_destroyed" | "crypto_shredded" | "raw_not_persisted" | "backup_expiry_pending";
export type RestrictedFragmentRestoreStatus = "not_allowed" | "allowed_by_policy" | "blocked_key_destroyed" | "blocked_expired" | "blocked_unauthorized" | "blocked_legal_hold" | "blocked_policy";
export interface RestrictedFragmentRedactedShadow {
    schemaVersion: number;
    fragmentId: string;
    tenantId: string;
    workspaceId: string;
    sourceMessageId: string;
    category: RestrictedFragmentCategory;
    policyId: string;
    redactionMarker: string;
    sanitizedSummary: string;
    lifecycleStatus: RestrictedFragmentLifecycleStatus;
    createdAt: string;
    expiresAt: string;
    legalHold: boolean;
    plaintextDigest?: string;
}
export interface RestrictedFragmentKeyScope {
    tenantId: string;
    workspaceId: string;
    retentionClass: string;
    policyId: string;
}
export interface RestrictedFragmentCiphertextMetadata {
    ciphertextObjectId: string;
    ciphertextDigest: string;
    nonceId: string;
    authenticationTagId: string;
}
export interface RestrictedFragmentWrappedKeyMetadata {
    wrappedDataKeyId: string;
    keyVersion: string;
    kmsProviderAlias: string;
    keyScope: RestrictedFragmentKeyScope;
}
export interface RestrictedFragmentEnvelope {
    schemaVersion: number;
    fragmentId: string;
    shadowId: string;
    algorithm: RestrictedFragmentEnvelopeAlgorithm;
    category: RestrictedFragmentCategory;
    purpose: string;
    retentionClass: string;
    policyId: string;
    ciphertext: RestrictedFragmentCiphertextMetadata;
    wrappedKey: RestrictedFragmentWrappedKeyMetadata;
    createdAt: string;
    expiresAt: string;
    legalHold: boolean;
}
export interface RestrictedFragmentAuditEvent {
    schemaVersion: number;
    eventType: RestrictedFragmentAuditEventType;
    fragmentId: string;
    tenantId: string;
    workspaceId: string;
    actorId: string;
    policyId: string;
    decisionId: string;
    category: RestrictedFragmentCategory;
    occurredAt: string;
    sanitizedSummary: string;
}
export interface RestrictedFragmentCryptoShredResult {
    fragmentId: string;
    tenantId: string;
    workspaceId: string;
    status: RestrictedFragmentLifecycleStatus;
    ciphertextDeleted: boolean;
    keyDestroyed: boolean;
    backupExpiryPending: boolean;
    auditEventId: string;
    completedAt: string;
}