export interface EncryptedData {
    algorithm: 'aes-256-gcm';
    iv: string;
    authTag: string;
    encrypted: string;
}
export interface AccountEncryption {
    encrypt(plaintext: string): EncryptedData;
    decrypt(encryptedData: EncryptedData): string;
    generateKey(): string;
    validateKey(key: string): boolean;
}
export declare class AccountEncryptionImpl implements AccountEncryption {
    private encryptionKey;
    private keySource;
    constructor(masterKey?: string);
    private resolveEncryptionKey;
    private generateDefaultKey;
    private deriveEncryptionKey;
    encrypt(plaintext: string): EncryptedData;
    decrypt(encryptedData: EncryptedData): string;
    generateKey(): string;
    validateKey(key: string): boolean;
    testEncryption(testData?: string): boolean;
    getKeySource(): 'environment' | 'generated';
    validateEncryptedData(encryptedData: unknown): encryptedData is EncryptedData;
    getEncryptionMetadata(): {
        algorithm: string;
        keySource: 'environment' | 'generated';
        version: string;
    };
}
export declare function createAccountEncryption(masterKey?: string): AccountEncryption;
export declare const defaultAccountEncryption: AccountEncryption;
//# sourceMappingURL=account-encryption.d.ts.map