import type { EncryptionProvider } from './providers/base.js';
import type { EncryptionRequest, EncryptionResult } from './types.js';
export type EnvelopeOptions = {
    dataKeyTtlMs?: number;
    maxCachedKeys?: number;
    keyVersion?: string;
};
/**
 * Envelope encryption with data key caching
 * Implements two-layer encryption pattern for better key management:
 * 1. Master key encrypts data keys (wrapped by provider)
 * 2. Data key encrypts actual payload
 *
 * Improves performance by caching data keys (with TTL)
 * and prevents unbounded memory growth with LRU eviction
 */
export declare class EnvelopeEncrypter {
    private readonly provider;
    private readonly cache;
    private readonly keyVersion;
    constructor(provider: EncryptionProvider, options?: EnvelopeOptions);
    encrypt(request: EncryptionRequest): Promise<EncryptionResult & {
        wrappedDataKey: EncryptionResult;
    }>;
    decrypt(payload: EncryptionResult & {
        wrappedDataKey: EncryptionResult;
    }): Promise<Uint8Array>;
    /**
     * Rotate to a new key version
     * Clears cache and updates version for key rotation
     */
    rotateKeyVersion(newVersion: string): void;
    /**
     * Get cache statistics (useful for monitoring)
     */
    getCacheStats(): {
        size: number;
        maxSize: number;
        ttlMs: number;
    };
}
//# sourceMappingURL=envelope.d.ts.map