import type { KeyIdentifier } from '@enbox/crypto';
import type { Dwn, RecordsWriteMessage } from '@enbox/dwn-sdk-js';
import type { DwnSigner } from './types/dwn.js';
import type { Web5PlatformAgent } from './types/agent.js';
/**
 * Reactively upgrades an externally-authored root record that has only
 * ProtocolPath encryption by appending a ProtocolContext recipient entry.
 *
 * After the upgrade, both the owner (ProtocolPath) and context key holders —
 * including the external author (ProtocolContext) — can decrypt the record.
 *
 * Steps:
 *   1. Decrypt the DEK using the owner's ProtocolPath-derived private key
 *   2. Derive the context public key from the owner's #enc key
 *   3. ECIES-encrypt the same DEK to the context public key
 *   4. Append the ProtocolContext recipient entry (using PR 0b append mode)
 *   5. Re-sign the record as owner
 *
 * @param agent - The platform agent
 * @param tenantDid - The DWN owner's DID
 * @param recordsWrite - The RecordsWrite message to upgrade
 * @param dwn - The DWN instance
 * @param getSigner - Function to get a DWN signer
 * @param contextKeyCache - Cache for context key info
 */
export declare function upgradeExternalRootRecord(agent: Web5PlatformAgent, tenantDid: string, recordsWrite: RecordsWriteMessage, dwn: Dwn, getSigner: (author: string) => Promise<DwnSigner>, contextKeyCache: {
    set(key: string, value: {
        keyId: string;
        keyUri: KeyIdentifier;
        contextDerivationPath: string[];
    }): void;
}): Promise<void>;
//# sourceMappingURL=dwn-record-upgrade.d.ts.map