export declare class EnvelopeEncryptionService {
    private readonly kmsRoot;
    constructor();
    deriveWrappingKey(args: {
        organizationId: string;
        userId: string;
    }): Buffer;
    encrypt(args: {
        organizationId: string;
        userId: string;
        plaintext: string;
    }): {
        ciphertext: string;
        keyId: string;
    };
    decrypt(args: {
        organizationId: string;
        userId: string;
        ciphertext: string;
    }): string;
}