import type { DerivedPrivateJwk, EncryptionInput, EncryptionKeyDeriver, KeyDecrypter, RecordsWriteMessage } from '@enbox/dwn-sdk-js';
import type { KeyIdentifier, PublicKeyJwk } from '@enbox/crypto';
import type { EnboxPlatformAgent } from './types/agent.js';
import type { DwnMessageReply, ProcessDwnRequest, SendDwnRequest } from './types/dwn.js';
import { ContentEncryptionAlgorithm, KeyDerivationScheme } from '@enbox/dwn-sdk-js';
import { DwnInterface } from './types/dwn.js';
/**
 * Returns the correct nonce/IV byte length for the given content encryption algorithm.
 * A256GCM uses 96-bit (12-byte) nonces; XC20P uses 192-bit (24-byte) nonces.
 */
export declare function ivLength(algorithm: ContentEncryptionAlgorithm): number;
/**
 * Builds a partial EncryptionInput object for a single key-encryption entry.
 * The `authenticationTag` is NOT set here — the caller must set it after
 * AEAD encryption produces the tag.
 */
export declare function buildEncryptionInput(dek: Uint8Array, iv: Uint8Array, publicKeyId: string, publicKey: PublicKeyJwk, derivationScheme: typeof KeyDerivationScheme.ProtocolPath | typeof KeyDerivationScheme.ProtocolContext): Omit<EncryptionInput, 'authenticationTag'>;
/**
 * Encrypts plaintext bytes with AEAD and computes the CID of the resulting ciphertext.
 * Returns everything needed to attach the encrypted data to a DWN message, including
 * the authentication tag.
 */
export declare function encryptAndComputeCid(plaintextBytes: Uint8Array, dek: Uint8Array, iv: Uint8Array, algorithm?: ContentEncryptionAlgorithm): Promise<{
    encryptedBytes: Uint8Array;
    dataCid: string;
    dataSize: number;
    authenticationTag: Uint8Array;
}>;
/**
 * Resolves the encryption key info for a given DID.
 * Looks up the keyAgreement verification method in the DID document,
 * then resolves the corresponding KMS key URI.
 *
 * @param agent - The platform agent to use for DID resolution and key management
 * @param didUri - The DID URI to resolve encryption key info for
 * @returns keyId (fully qualified verification method ID), keyUri (KMS reference),
 *          and publicKeyJwk. No private key material is returned.
 * @throws If the DID has no keyAgreement verification method or it's not X25519.
 */
export declare function getEncryptionKeyInfo(agent: EnboxPlatformAgent, didUri: string): Promise<{
    keyId: string;
    keyUri: KeyIdentifier;
    publicKeyJwk: PublicKeyJwk;
}>;
/**
 * Derives a ProtocolContext public key for a given DID and context ID,
 * then returns a fully-formed EncryptionInput. Consolidates the repeated
 * getEncryptionKeyInfo -> constructKeyDerivationPath -> derivePublicKey
 * -> build EncryptionInput sequence.
 *
 * @param agent - The platform agent
 * @param didUri - The DID URI to derive encryption key for
 * @param contextId - The context ID
 * @param dek - Data encryption key
 * @param iv - Initialization vector
 */
export declare function deriveContextEncryptionInput(agent: EnboxPlatformAgent, didUri: string, contextId: string, dek: Uint8Array, iv: Uint8Array): Promise<{
    encryptionInput: Omit<EncryptionInput, 'authenticationTag'>;
    keyId: string;
    keyUri: KeyIdentifier;
    contextDerivationPath: string[];
}>;
/**
 * Builds a KMS-backed JWE key unwrap callback. Used for both ProtocolPath
 * and ProtocolContext decryption where the KMS holds the root private key.
 *
 * @param agent - The platform agent with access to the key manager
 * @param keyId - The root key ID
 * @param keyUri - The KMS key URI
 * @param derivationScheme - The key derivation scheme
 */
export declare function buildKmsDecryptCallback(agent: EnboxPlatformAgent, keyId: string, keyUri: KeyIdentifier, derivationScheme: typeof KeyDerivationScheme.ProtocolPath | typeof KeyDerivationScheme.ProtocolContext): KeyDecrypter;
/**
 * Constructs an EncryptionKeyDeriver callback for the SDK.
 * The SDK calls derivePublicKey(path), the KMS performs HKDF + public key
 * computation internally. The private key never leaves the KMS.
 *
 * Analogous to getSigner() for signing operations.
 *
 * @param agent - The platform agent
 * @param didUri - The DID URI to create the key deriver for
 * @returns An EncryptionKeyDeriver callback object
 */
export declare function getEncryptionKeyDeriver(agent: EnboxPlatformAgent, didUri: string): Promise<EncryptionKeyDeriver>;
/**
 * Constructs a ProtocolPath KeyDecrypter.
 *
 * @param agent - The platform agent
 * @param didUri - The DID URI to create the key decrypter for
 * @returns A KeyDecrypter callback object
 */
export declare function getKeyDecrypter(agent: EnboxPlatformAgent, didUri: string): Promise<KeyDecrypter>;
/**
 * Builds a KeyDecrypter from a context-derived private key.
 * Uses the raw key directly (since it was shared with us via the key-delivery protocol).
 *
 * @param contextKey - The derived private key for the context
 */
export declare function buildContextKeyDecrypter(contextKey: DerivedPrivateJwk): KeyDecrypter;
/** Cache entry shape for scope-aware delegate decryption keys. */
export type DelegateDecryptionKeyEntry = {
    protocol: string;
    scope: {
        kind: 'protocol';
    } | {
        kind: 'protocolPath';
        protocolPath: string;
        match: 'exact';
    };
    derivedPrivateKey: DerivedPrivateJwk;
};
/**
 * Builds a KeyDecrypter for an exact-path delegate key that enforces the
 * record's full derivation path matches the key's path exactly — siblings
 * and descendants are NOT accessible.
 */
export declare function buildExactProtocolPathDecrypter(key: DerivedPrivateJwk): KeyDecrypter;
/**
 * Resolves the appropriate KeyDecrypter for a record's encryption scheme.
 * Handles both single-party (ProtocolPath) and multi-party (ProtocolContext).
 *
 * For ProtocolPath records:
 *   - Owner: derives key directly from KMS
 *   - Delegate with protocol-wide key: uses ancestor-prefix derivation
 *   - Delegate with exact-path key: enforces exact path match
 *
 * For ProtocolContext records:
 *   - Delegate: uses delivered context key from the connect flow
 *   - Context creator: derives key directly from KMS
 *   - Participant: fetches contextKey via key-delivery protocol, caches it
 *
 * @param agent - The platform agent
 * @param authorDid - The DID of the author attempting to decrypt
 * @param recordsWrite - The records write message containing encryption info
 * @param targetDid - The target DID (DWN owner), if known
 * @param contextDerivedKeyCache - Cache for context-derived private keys
 * @param fetchContextKeyRecordFn - Function to fetch context key records from key-delivery protocol
 * @param delegateDecryptionKeyCache - Cache for scope-aware delegate decryption keys
 * @param granteeDid - The delegate DID (if this is a delegated request)
 */
export declare function resolveKeyDecrypter(agent: EnboxPlatformAgent, authorDid: string, recordsWrite: RecordsWriteMessage, targetDid: string | undefined, contextDerivedKeyCache: {
    get(key: string): DerivedPrivateJwk | undefined;
    set(key: string, value: DerivedPrivateJwk): void;
}, fetchContextKeyRecordFn: (params: {
    ownerDid: string;
    requesterDid: string;
    sourceProtocol: string;
    sourceContextId: string;
}) => Promise<DerivedPrivateJwk | undefined>, delegateDecryptionKeyCache?: {
    get(key: string): DelegateDecryptionKeyEntry[] | undefined;
}, granteeDid?: string, delegateContextKeyCache?: {
    get(key: string): DerivedPrivateJwk | undefined;
    set(key: string, value: DerivedPrivateJwk): void;
}): Promise<KeyDecrypter>;
/**
 * Post-processes a DWN reply, auto-decrypting data if encryption is enabled.
 * Delegates to the SDK's Records.decrypt() with the appropriate KeyDecrypter —
 * resolveKeyDecrypter() selects between ProtocolPath and ProtocolContext schemes.
 *
 * @param request - The original DWN request
 * @param reply - The DWN reply to process
 * @param agent - The platform agent
 * @param contextDerivedKeyCache - Cache for context-derived private keys
 * @param fetchContextKeyRecordFn - Function to fetch context key records
 * @param delegateDecryptionKeyCache - Cache for scope-aware delegate decryption keys
 */
export declare function maybeDecryptReply<T extends DwnInterface>(request: ProcessDwnRequest<T> | SendDwnRequest<T>, reply: DwnMessageReply[T], agent: EnboxPlatformAgent, contextDerivedKeyCache: {
    get(key: string): DerivedPrivateJwk | undefined;
    set(key: string, value: DerivedPrivateJwk): void;
}, fetchContextKeyRecordFn: (params: {
    ownerDid: string;
    requesterDid: string;
    sourceProtocol: string;
    sourceContextId: string;
}) => Promise<DerivedPrivateJwk | undefined>, delegateDecryptionKeyCache?: {
    get(key: string): DelegateDecryptionKeyEntry[] | undefined;
}, delegateContextKeyCache?: {
    get(key: string): DerivedPrivateJwk | undefined;
    set(key: string, value: DerivedPrivateJwk): void;
}): Promise<void>;
//# sourceMappingURL=dwn-encryption.d.ts.map