import type { PublicKeyJwk } from '@enbox/crypto';
import type { DerivedPrivateJwk } from '@enbox/dwn-sdk-js';
import type { Web5PlatformAgent } from './types/agent.js';
import type { DwnMessage, DwnMessageReply, ProcessDwnRequest } from './types/dwn.js';
import { DwnInterface } from './types/dwn.js';
/**
 * Parameters for writeContextKeyRecord.
 */
export type WriteContextKeyParams = {
    tenantDid: string;
    recipientDid: string;
    contextKeyData: DerivedPrivateJwk;
    sourceProtocol: string;
    sourceContextId: string;
    recipientKeyDeliveryPublicKey?: {
        rootKeyId: string;
        publicKeyJwk: PublicKeyJwk;
    };
};
/**
 * Parameters for fetchContextKeyRecord.
 */
export type FetchContextKeyParams = {
    ownerDid: string;
    requesterDid: string;
    sourceProtocol: string;
    sourceContextId: string;
};
/** Callback type for processRequest, used by key-delivery functions. */
type ProcessRequestFn = <T extends DwnInterface>(request: ProcessDwnRequest<T>) => Promise<{
    reply: DwnMessageReply[T];
    message?: DwnMessage[T];
    messageCid: string;
}>;
/**
 * Ensures the key delivery protocol is installed on the given tenant's DWN,
 * with `$encryption` keys injected. Uses the same lazy initialization pattern
 * as `DwnDataStore.initialize()`.
 *
 * @param agent - The platform agent
 * @param tenantDid - The DID of the DWN owner
 * @param processRequest - The agent's processRequest method (bound)
 * @param getProtocolDefinition - Function to get a protocol definition
 * @param installedCache - Cache for installation status
 */
export declare function ensureKeyDeliveryProtocol(agent: Web5PlatformAgent, tenantDid: string, processRequest: ProcessRequestFn, getProtocolDefinition: (tenantDid: string, protocolUri: string) => Promise<any>, installedCache: {
    get(key: string): boolean | undefined;
    set(key: string, value: boolean): void;
    delete(key: string): void;
}, protocolDefinitionCache: {
    delete(key: string): void;
}): Promise<void>;
/**
 * Writes a `contextKey` record to the owner's DWN, delivering an encrypted
 * context key to a participant.
 *
 * The payload is encrypted to the **recipient's** ProtocolPath-derived public
 * key on the key-delivery protocol, so only the recipient can decrypt it.
 *
 * @param agent - The platform agent
 * @param params - The write parameters
 * @param processRequest - The agent's processRequest method (bound)
 * @param ensureProtocol - Function to ensure key delivery protocol is installed
 * @param eagerSend - Function to eagerly send the record to the remote DWN
 * @returns The recordId of the written contextKey record
 */
export declare function writeContextKeyRecord(agent: Web5PlatformAgent, params: WriteContextKeyParams, processRequest: ProcessRequestFn, ensureProtocol: (tenantDid: string) => Promise<void>, eagerSend: (tenantDid: string, message: DwnMessage[DwnInterface.RecordsWrite]) => Promise<void>): Promise<string>;
/**
 * Eagerly sends a contextKey record to the tenant's remote DWN.
 * This is best-effort — sync guarantees eventual consistency regardless.
 *
 * @param agent - The platform agent
 * @param tenantDid - The DWN owner's DID
 * @param contextKeyMessage - The context key message to send
 * @param getDwnMessage - Function to read a full message from local DWN
 * @param sendDwnRpcRequest - Function to send a DWN RPC request
 */
export declare function eagerSendContextKeyRecord(agent: Web5PlatformAgent, tenantDid: string, contextKeyMessage: DwnMessage[DwnInterface.RecordsWrite], getDwnMessage: (params: {
    author: string;
    messageType: DwnInterface;
    messageCid: string;
}) => Promise<{
    message: any;
    data?: Blob;
}>, sendDwnRpcRequest: (params: {
    targetDid: string;
    dwnEndpointUrls: string[];
    message: any;
    data?: Blob;
}) => Promise<any>): Promise<void>;
/**
 * Fetches and decrypts a `contextKey` record from a DWN, returning the
 * `DerivedPrivateJwk` payload.
 *
 * Supports both local reads (tenant queries own DWN) and remote reads
 * (participant queries the context owner's DWN).
 *
 * @param agent - The platform agent
 * @param params - The fetch parameters
 * @param processRequest - The agent's processRequest method (bound)
 * @param getSigner - Function to get a signer for a DID
 * @param sendDwnRpcRequest - Function to send a DWN RPC request
 * @returns The decrypted `DerivedPrivateJwk`, or `undefined` if no matching record found
 */
export declare function fetchContextKeyRecord(agent: Web5PlatformAgent, params: FetchContextKeyParams, processRequest: ProcessRequestFn, getSigner: (author: string) => Promise<any>, sendDwnRpcRequest: (params: {
    targetDid: string;
    dwnEndpointUrls: string[];
    message: any;
    data?: Blob;
}) => Promise<any>): Promise<DerivedPrivateJwk | undefined>;
export {};
//# sourceMappingURL=dwn-key-delivery.d.ts.map