import type { DerivedPrivateJwk, DwnConfig, EncryptionKeyDeriver, ProtocolDefinition } from '@enbox/dwn-sdk-js';
import type { PublicKeyJwk } from '@enbox/crypto';
import { Dwn } from '@enbox/dwn-sdk-js';
import type { Web5PlatformAgent } from './types/agent.js';
import type { DwnResponse, ProcessDwnRequest, SendDwnRequest } from './types/dwn.js';
import { DwnInterface } from './types/dwn.js';
export { isDwnMessage, isDwnRequest, isMessagesPermissionScope, isRecordPermissionScope, isRecordsType } from './dwn-type-guards.js';
type DwnApiParams = {
    agent?: Web5PlatformAgent;
    dwn: Dwn;
};
interface DwnApiCreateDwnParams extends Partial<DwnConfig> {
    dataPath?: string;
}
export declare class AgentDwnApi {
    /**
     * Holds the instance of a `Web5PlatformAgent` that represents the current execution context for
     * the `AgentDwnApi`. This agent is used to interact with other Web5 agent components. It's vital
     * to ensure this instance is set to correctly contextualize operations within the broader Web5
     * Agent framework.
     */
    private _agent?;
    /**
     * The DWN instance to use for this API.
     */
    private _dwn;
    /**
     * Protocol definition cache — TTL 30 minutes. Protocols rarely change.
     * Keyed by `${tenantDid}~${protocolUri}`.
     */
    private _protocolDefinitionCache;
    /**
     * Context key cache — stores resolved context encryption key info for
     * multi-party protocols. Keyed by rootContextId. TTL 30 minutes.
     */
    private _contextKeyCache;
    /**
     * Context-derived private key cache — stores DerivedPrivateJwk for contexts
     * where the current user is a participant (not the creator).
     * Keyed by `ctx~${authorDid}~${rootContextId}`. TTL 30 minutes.
     */
    private _contextDerivedKeyCache;
    constructor({ agent, dwn }: DwnApiParams);
    /**
     * Retrieves the `Web5PlatformAgent` execution context.
     *
     * @returns The `Web5PlatformAgent` instance that represents the current execution context.
     * @throws Will throw an error if the `agent` instance property is undefined.
     */
    get agent(): Web5PlatformAgent;
    set agent(agent: Web5PlatformAgent);
    /**
     * Public getter for the DWN instance used by this API.
     *
     * Notes:
     * - This getter is public to allow advanced developers to access the DWN instance directly.
     *   However, it is recommended to use the `processRequest` method to interact with the DWN
     *   instance to ensure that the DWN message is constructed correctly.
     * - The getter is named `node` to avoid confusion with the `dwn` property of the
     *   `Web5PlatformAgent`. In other words, so that a developer can call `agent.dwn.node` to access
     *   the DWN instance and not `agent.dwn.dwn`.
     */
    get node(): Dwn;
    static createDwn({ dataPath, dataStore, didResolver, stateIndex, eventLog, messageStore, tenantGate, resumableTaskStore }: DwnApiCreateDwnParams): Promise<Dwn>;
    processRequest<T extends DwnInterface>(request: ProcessDwnRequest<T>): Promise<DwnResponse<T>>;
    sendRequest<T extends DwnInterface>(request: SendDwnRequest<T>): Promise<DwnResponse<T>>;
    /**
     * Post-write key delivery: after a successful encrypted `RecordsWrite`,
     * detect new participants and write `contextKey` records so they can
     * decrypt records in the context.
     *
     * This is a non-fatal operation — if participant detection or key delivery
     * fails, the record is still stored and a warning is logged.
     */
    private postWriteKeyDelivery;
    private sendDwnRpcRequest;
    private constructDwnMessage;
    private hasGrantParams;
    private getSigner;
    /**
     * Constructs an EncryptionKeyDeriver callback for the SDK.
     * Delegates to the standalone function in `dwn-encryption.ts`.
     *
     * @param didUri - The DID URI to create the key deriver for
     * @returns An EncryptionKeyDeriver callback object
     */
    getEncryptionKeyDeriver(didUri: string): Promise<EncryptionKeyDeriver>;
    /**
     * Resolves the keyAgreement verification method for the given DID and returns
     * the key ID, key URI, and public key JWK.
     *
     * @param didUri - The DID URI to look up
     */
    private getEncryptionKeyInfo;
    /**
     * Constructs a ProtocolPath KeyDecrypter for the given DID.
     *
     * @param didUri - The DID URI to build a decrypter for
     */
    private getKeyDecrypter;
    /**
     * Analyses a record write to determine which DIDs need context key delivery.
     *
     * @param params - Parameters for participant detection
     * @returns Set of DIDs that need context key delivery
     */
    detectNewParticipants(params: {
        protocolDefinition: ProtocolDefinition;
        protocolPath: string;
        recipient?: string;
        tenantDid: string;
        authorDid?: string;
    }): Set<string>;
    /**
     * Fetches a protocol definition from the local DWN, with caching.
     * Returns undefined if the protocol is not installed.
     *
     * @param tenantDid - The tenant DID to query
     * @param protocolUri - The protocol URI to fetch
     * @returns The protocol definition, or undefined if not found
     */
    private getProtocolDefinition;
    /**
     * Fetches a protocol definition from a remote DWN.
     * Uses an unsigned ProtocolsQuery (public protocols can be queried anonymously).
     */
    private fetchRemoteProtocolDefinition;
    /**
     * Extracts the `derivedPublicKey` from an existing ProtocolContext-encrypted
     * record in a context on a remote DWN. This key allows an external author to
     * encrypt new records in the same context without knowing the context private key.
     *
     * @param targetDid      - The DWN owner's DID
     * @param protocolUri    - The protocol URI to search
     * @param rootContextId  - The root context ID
     * @param requesterDid   - The DID of the requester (used for signing the query)
     * @returns The rootKeyId and derivedPublicKey, or undefined if no ProtocolContext
     *          record exists yet
     */
    private extractDerivedPublicKey;
    /**
     * Post-processes a DWN reply, auto-decrypting data if encryption is enabled.
     * Delegates to the standalone function in `dwn-encryption.ts`.
     */
    private maybeDecryptReply;
    private getDwnMessage;
    /**
     * Cache for key delivery protocol installation status per tenant.
     * Once confirmed installed, we skip re-checking for 21 days.
     */
    private _keyDeliveryProtocolInstalledCache;
    /**
     * Ensures the key delivery protocol is installed on the given tenant's DWN,
     * with `$encryption` keys injected.
     *
     * @param tenantDid - The DID of the DWN owner
     */
    ensureKeyDeliveryProtocol(tenantDid: string): Promise<void>;
    /**
     * Writes a `contextKey` record to the owner's DWN, delivering an encrypted
     * context key to a participant.
     *
     * @param params - The write parameters
     * @returns The recordId of the written contextKey record
     */
    writeContextKeyRecord(params: {
        tenantDid: string;
        recipientDid: string;
        contextKeyData: DerivedPrivateJwk;
        sourceProtocol: string;
        sourceContextId: string;
        recipientKeyDeliveryPublicKey?: {
            rootKeyId: string;
            publicKeyJwk: PublicKeyJwk;
        };
    }): Promise<string>;
    /**
     * Eagerly sends a contextKey record to the tenant's remote DWN.
     * This is best-effort — sync guarantees eventual consistency regardless.
     */
    private eagerSendContextKeyRecord;
    /**
     * Fetches and decrypts a `contextKey` record from a DWN, returning the
     * `DerivedPrivateJwk` payload.
     *
     * @param params - The fetch parameters
     * @returns The decrypted `DerivedPrivateJwk`, or `undefined` if no matching record found
     */
    fetchContextKeyRecord(params: {
        ownerDid: string;
        requesterDid: string;
        sourceProtocol: string;
        sourceContextId: string;
    }): Promise<DerivedPrivateJwk | undefined>;
}
//# sourceMappingURL=dwn-api.d.ts.map