import type { DataEncodedRecordsWriteMessage, DerivedPrivateJwk, EncryptionControlAudiencePayload, EncryptionControlDeliveryPayload, EncryptionInput, EncryptionKeyDeriver, KeyDecrypter, KeyDecrypterDerivationScheme, ProtocolDefinition, RecordsWriteMessage, RoleAudienceKeyMaterial } from '@enbox/dwn-sdk-js';
import type { KeyIdentifier, PrivateKeyJwk, PublicKeyJwk } from '@enbox/crypto';
import type { EnboxPlatformAgent } from './types/agent.js';
import type { DwnMessageReply, ProcessDwnRequest, SendDwnRequest } from './types/dwn.js';
import { ContentEncryptionAlgorithm, EncryptionControlDeliveryRecipientAuthority, KeyDerivationScheme } from '@enbox/dwn-sdk-js';
import { DwnInterface } from './types/dwn.js';
type DelegateDecryptionKeyCache = {
    get(key: string): DelegateDecryptionKeyEntry[] | undefined;
    set?(key: string, value: DelegateDecryptionKeyEntry[]): void;
};
type ResolveKeyDecrypterParams = {
    agent: EnboxPlatformAgent;
    authorDid: string;
    recordsWrite: RecordsWriteMessage;
    targetDid: string | undefined;
    delegateDecryptionKeyCache?: DelegateDecryptionKeyCache;
    granteeDid?: string;
    audienceDecryptionKeyCache?: AudienceDecryptionKeyCache;
    delegatedGrant?: DataEncodedRecordsWriteMessage;
};
export type AudienceDecryptionKeyCache = {
    get(key: string): AudienceDecryptionKeyEntry | undefined;
    set?(key: string, value: AudienceDecryptionKeyEntry): void;
};
export type AudienceKeyPayload = EncryptionControlDeliveryPayload;
export type AudienceDecryptionKeyEntry = {
    sourceDid: string;
    recipientDid: string;
    protocol: string;
    contextId: string;
    rolePath: string;
    keyMaterial: RoleAudienceKeyMaterial;
};
/**
 * Returns the IV/counter byte length for DWN content encryption.
 */
export declare function ivLength(_algorithm: ContentEncryptionAlgorithm): number;
/**
 * Builds a partial EncryptionInput object for a single key-encryption entry.
 */
export declare function buildEncryptionInput(dek: Uint8Array, iv: Uint8Array, keyId: string, publicKey: PublicKeyJwk, derivationScheme: typeof KeyDerivationScheme.ProtocolPath): EncryptionInput;
/**
 * Encrypts plaintext bytes and computes the CID of the resulting ciphertext.
 */
export declare function encryptAndComputeCid(plaintextBytes: Uint8Array, dek: Uint8Array, iv: Uint8Array, algorithm?: ContentEncryptionAlgorithm): Promise<{
    encryptedBytes: Uint8Array;
    dataCid: string;
    dataSize: number;
}>;
/**
 * Resolves the encryption key info for a given DID.
 * Looks up the keyAgreement verification method in the DID document,
 * then resolves the corresponding KMS key URI.
 *
 * @param agent - The platform agent to use for DID resolution and key management
 * @param didUri - The DID URI to resolve encryption key info for
 * @returns keyId (fully qualified verification method ID), keyUri (KMS reference),
 *          and publicKeyJwk. No private key material is returned.
 * @throws If the DID has no keyAgreement verification method or it's not X25519.
 */
export declare function getEncryptionKeyInfo(agent: EnboxPlatformAgent, didUri: string): Promise<{
    keyId: string;
    keyUri: KeyIdentifier;
    publicKeyJwk: PublicKeyJwk;
}>;
/**
 * Builds a KMS-backed key unwrap callback.
 *
 * @param agent - The platform agent with access to the key manager
 * @param keyId - The root key ID
 * @param keyUri - The KMS key URI
 * @param derivationScheme - The key derivation scheme
 */
export declare function buildKmsDecryptCallback(agent: EnboxPlatformAgent, keyId: string, keyUri: KeyIdentifier, derivationScheme: typeof KeyDerivationScheme.ProtocolPath): KeyDecrypter;
/**
 * Constructs an EncryptionKeyDeriver callback for the SDK.
 * The SDK calls derivePublicKey(path), the KMS performs HKDF + public key
 * computation internally. The private key never leaves the KMS.
 *
 * Analogous to getSigner() for signing operations.
 *
 * @param agent - The platform agent
 * @param didUri - The DID URI to create the key deriver for
 * @returns An EncryptionKeyDeriver callback object
 */
export declare function getEncryptionKeyDeriver(agent: EnboxPlatformAgent, didUri: string): Promise<EncryptionKeyDeriver>;
/**
 * Constructs a ProtocolPath KeyDecrypter.
 *
 * @param agent - The platform agent
 * @param didUri - The DID URI to create the key decrypter for
 * @returns A KeyDecrypter callback object
 */
export declare function getKeyDecrypter(agent: EnboxPlatformAgent, didUri: string): Promise<KeyDecrypter>;
/**
 * Builds a KeyDecrypter from a delivered protocol/path-derived private key.
 *
 * @param key - The delivered derived private key
 */
export declare function buildProtocolPathSubtreeDecrypter(key: DerivedPrivateJwk): KeyDecrypter;
export declare function buildFixedPrivateKeyDecrypter(params: {
    keyId: string;
    derivationScheme: KeyDecrypterDerivationScheme;
    publicKeyJwk: PublicKeyJwk;
    privateKeyJwk: PrivateKeyJwk;
}): KeyDecrypter;
/** Cache entry shape for scope-aware delegate decryption keys. */
export type DelegateDecryptionKeyEntry = {
    grantorDid: string;
    protocol: string;
    scope: {
        kind: 'protocol';
    } | {
        kind: 'protocolPath';
        protocolPath: string;
    };
    derivedPrivateKey: DerivedPrivateJwk;
};
/**
 * Creates durable grantKey records for read grants that carry encrypted protocol access.
 *
 * The record payload delivers the owner-derived ProtocolPath private key. The record
 * itself is encrypted to the grantee's own Encryption Protocol `grantKey` path.
 */
export declare function createGrantKeyRecordsForGrants(params: {
    agent: EnboxPlatformAgent;
    ownerDid: string;
    granteeDid: string;
    granteeRootPrivateKey: PrivateKeyJwk;
    grantMessages: DataEncodedRecordsWriteMessage[];
    protocolDefinitions?: ProtocolDefinition[];
}): Promise<DataEncodedRecordsWriteMessage[]>;
/**
 * Writes a durable audience record whose plaintext payload seals the audience private key to the tenant role-path key.
 */
export declare function createAudienceRecord(params: {
    agent: EnboxPlatformAgent;
    sourceDid: string;
    authorDid: string;
    protocol: string;
    rolePath: string;
    contextId: string;
    sealingPublicKey: PublicKeyJwk;
    audienceKey?: AudienceKeyPayload;
    granteeDid?: string;
    permissionGrantId?: string;
    delegatedGrant?: DataEncodedRecordsWriteMessage;
    protocolRole?: string;
}): Promise<{
    audienceKey: AudienceKeyPayload;
    message: DataEncodedRecordsWriteMessage;
    payload: EncryptionControlAudiencePayload;
}>;
/**
 * Generates fresh random role-audience key material for one source-protocol audience tuple.
 */
export declare function generateAudienceKey(params: {
    protocol: string;
    rolePath: string;
    contextId: string;
}): Promise<AudienceKeyPayload>;
/**
 * Writes a durable encrypted delivery record that wraps audience private key material to one recipient.
 */
export declare function createAudienceDeliveryRecord(params: {
    agent: EnboxPlatformAgent;
    sourceDid: string;
    authorDid: string;
    recipientDid: string;
    recipientRolePublicKey: PublicKeyJwk;
    audienceKey: AudienceKeyPayload;
    recipientAuthority: EncryptionControlDeliveryRecipientAuthority;
    granteeDid?: string;
    permissionGrantId?: string;
    delegatedGrant?: DataEncodedRecordsWriteMessage;
    protocolRole?: string;
}): Promise<DataEncodedRecordsWriteMessage>;
/**
 * Opens an audience seal and verifies the recovered private key against the audience record payload.
 */
export declare function unsealAudienceKey(params: {
    payload: EncryptionControlAudiencePayload;
    sealingPrivateKey: PrivateKeyJwk;
}): Promise<RoleAudienceKeyMaterial>;
/**
 * Verifies that delivered or unsealed audience key material matches the accepted audience record.
 */
export declare function verifyAudienceKeyMaterial(params: {
    keyMaterial: RoleAudienceKeyMaterial;
    payload: {
        protocol: string;
        rolePath: string;
        contextId: string;
        keyId: string;
    };
    publicKeyJwk: PublicKeyJwk;
}): Promise<void>;
/**
 * Resolves the appropriate KeyDecrypter for a record's encryption scheme.
 *
 * Owners derive protocol-path keys directly from KMS. Delegates use delivered
 * protocol-wide or path-subtree decryption keys when available.
 *
 * @param params - Decryption resolution inputs.
 */
export declare function resolveKeyDecrypter(params: ResolveKeyDecrypterParams): Promise<KeyDecrypter>;
/**
 * Post-processes a DWN reply, auto-decrypting data if encryption is enabled.
 * Delegates to the SDK's Records.decrypt() with the appropriate KeyDecrypter —
 * resolveKeyDecrypter() selects either a delivered delegate key or KMS.
 *
 * @param request - The original DWN request
 * @param reply - The DWN reply to process
 * @param agent - The platform agent
 * @param delegateDecryptionKeyCache - Cache for scope-aware delegate decryption keys
 */
export declare function maybeDecryptReply<T extends DwnInterface>(request: ProcessDwnRequest<T> | SendDwnRequest<T>, reply: DwnMessageReply[T], agent: EnboxPlatformAgent, delegateDecryptionKeyCache?: DelegateDecryptionKeyCache, audienceDecryptionKeyCache?: AudienceDecryptionKeyCache): Promise<void>;
export declare function resolveAudienceDecryptionKey(params: {
    agent: EnboxPlatformAgent;
    sourceDid: string;
    recipientDid: string;
    protocol: string;
    contextId: string;
    rolePath: string;
    keyId: string;
    granteeDid?: string;
    delegatedGrant?: DataEncodedRecordsWriteMessage;
    delegateDecryptionKeyCache?: DelegateDecryptionKeyCache;
    audienceDecryptionKeyCache?: AudienceDecryptionKeyCache;
}): Promise<AudienceDecryptionKeyEntry | undefined>;
/**
 * Returns whether the actor can derive the tenant role-path private key that opens audience seals.
 */
export declare function hasAudienceSealCoverage(params: {
    agent: EnboxPlatformAgent;
    sourceDid: string;
    protocol: string;
    rolePath: string;
    granteeDid?: string;
    delegateDecryptionKeyCache?: DelegateDecryptionKeyCache;
}): Promise<boolean>;
export declare function getAudienceDecryptionKeyCacheKey(input: {
    sourceDid: string;
    recipientDid: string;
    protocol: string;
    contextId: string;
    rolePath: string;
    keyId: string;
}): string;
export {};
//# sourceMappingURL=dwn-encryption.d.ts.map