import type { KyselyPlugin } from 'kysely';
import type { ClassificationManifest } from '@pikku/core/classification';
import { type ClassificationCrypto } from './classification-crypto.js';
export interface CreateClassificationPluginOptions {
    manifest: ClassificationManifest;
    crypto: ClassificationCrypto;
}
/**
 * Make a column's at-rest form a property of the column rather than of the
 * developer's memory.
 *
 * Reads are transparent: a `wrapped` column comes back decrypted, so
 * application code never sees an envelope. `hashed` and `plain` columns are
 * untouched, which is what keeps the rest of the schema queryable.
 *
 * Writes are *guarded* rather than transformed, and the reason is Kysely's
 * shape, not a preference: `transformQuery` is synchronous and WebCrypto is
 * not, so a plugin cannot encrypt on the way in. Encrypting at the call site
 * and letting a forgotten call slip through silently is the failure this
 * design exists to prevent, so the guard refuses any plaintext heading for a
 * `wrapped` or `sealed` column. Values are produced with
 * `ClassificationCrypto.encryptColumn`.
 *
 * A `sealed` column is never decrypted on the way out — the application holds
 * only the public half by definition, so returning it as stored is correct
 * rather than a gap.
 */
export declare function createClassificationPlugin(options: CreateClassificationPluginOptions): KyselyPlugin;