import type { Jwk } from '@enbox/crypto';
import type { PublicKeyJwk } from '../types/jose-types.js';
import { KeyDerivationScheme } from './hd-key.js';
/**
 * Content encryption algorithms supported by the DWN.
 * Both are AEAD (Authenticated Encryption with Associated Data) ciphers.
 */
export declare enum ContentEncryptionAlgorithm {
    /** AES-256 in Galois/Counter Mode. NIST-approved, hardware-accelerated. 96-bit nonce. */
    A256GCM = "A256GCM",
    /** XChaCha20-Poly1305. 192-bit nonce (safe to randomize). Constant-time. */
    XC20P = "XC20P"
}
/**
 * Key agreement algorithm used by the DWN.
 * ECDH-ES with X25519 key agreement and AES-256 Key Wrap.
 */
export declare enum KeyAgreementAlgorithm {
    EcdhEsA256kw = "ECDH-ES+A256KW"
}
/**
 * JWE Protected Header for DWN encryption.
 */
export type JweProtectedHeader = {
    alg: KeyAgreementAlgorithm;
    enc: ContentEncryptionAlgorithm;
};
/**
 * Per-recipient header in a JWE General JSON Serialization.
 */
export type JweRecipientHeader = {
    /** Fully qualified key ID of the root key used in key derivation (e.g. did:example:alice#enc). */
    kid: string;
    /** Ephemeral X25519 public key used for ECDH key agreement. */
    epk: PublicKeyJwk;
    /** Key derivation scheme used to derive the recipient's key. */
    derivationScheme: KeyDerivationScheme;
    /** Derived public key. Present when derivationScheme is 'protocolContext'. */
    derivedPublicKey?: PublicKeyJwk;
};
/**
 * A single recipient entry in the JWE General JSON Serialization.
 */
export type JweRecipient = {
    header: JweRecipientHeader;
    encrypted_key: string;
};
/**
 * JWE-inspired structure used as the `encryption` property on RecordsWrite messages.
 *
 * This follows the JWE General JSON Serialization (RFC 7516 Section 7.2) with one adaptation:
 * the `ciphertext` is NOT included here because the encrypted record data is stored separately
 * in the DataStore (or as inline `encodedData`). Only the key wrapping metadata, IV, and
 * authentication tag are stored in this structure.
 */
export type JweEncryption = {
    /** Base64url-encoded JWE Protected Header. */
    protected: string;
    /** Base64url-encoded initialization vector for content encryption. */
    iv: string;
    /** Base64url-encoded authentication tag from the AEAD cipher. */
    tag: string;
    /** Array of recipient entries, one per recipient or derivation path. */
    recipients: JweRecipient[];
};
/**
 * Input describing how to encrypt a key for a single recipient.
 */
export type KeyEncryptionInput = {
    /** Fully qualified key ID of the recipient's root encryption key. */
    publicKeyId: string;
    /** The recipient's derived X25519 public key. */
    publicKey: PublicKeyJwk;
    /** Key derivation scheme. */
    derivationScheme: KeyDerivationScheme;
    /** Algorithm for key agreement. Defaults to ECDH-ES+A256KW. */
    algorithm?: KeyAgreementAlgorithm;
};
/**
 * Input describing how to encrypt record data.
 */
export type EncryptionInput = {
    /** Content encryption algorithm. Defaults to A256GCM. */
    algorithm?: ContentEncryptionAlgorithm;
    /** The Content Encryption Key (CEK). Must be 32 bytes (256-bit). */
    key: Uint8Array;
    /** Initialization vector. 12 bytes for A256GCM, 24 bytes for XC20P. */
    initializationVector: Uint8Array;
    /** Authentication tag from the AEAD encryption of the record data. */
    authenticationTag: Uint8Array;
    /** Recipient key encryption inputs. */
    keyEncryptionInputs: KeyEncryptionInput[];
};
/**
 * Payload passed to a KeyDecrypter callback for JWE-based key unwrapping.
 */
export type JweKeyUnwrapPayload = {
    /** The wrapped CEK bytes. */
    encryptedKey: Uint8Array;
    /** The ephemeral X25519 public key used for ECDH. */
    ephemeralPublicKey: PublicKeyJwk;
};
/**
 * Utility class for DWN encryption operations using JWE (RFC 7516).
 * Uses ECDH-ES+A256KW key agreement with X25519 and either AES-256-GCM or XChaCha20-Poly1305
 * for authenticated content encryption.
 */
export declare class Encryption {
    /**
     * Encrypts data using an AEAD cipher (A256GCM or XC20P).
     * Returns ciphertext with the authentication tag appended.
     */
    static aeadEncrypt(algorithm: ContentEncryptionAlgorithm, keyBytes: Uint8Array, iv: Uint8Array, plaintext: Uint8Array): Promise<{
        ciphertext: Uint8Array;
        tag: Uint8Array;
    }>;
    /**
     * Decrypts data using an AEAD cipher (A256GCM or XC20P).
     * Expects ciphertext and tag as separate inputs.
     */
    static aeadDecrypt(algorithm: ContentEncryptionAlgorithm, keyBytes: Uint8Array, iv: Uint8Array, ciphertext: Uint8Array, tag: Uint8Array): Promise<Uint8Array>;
    /**
     * Encrypts data as a ReadableStream using an AEAD cipher.
     * Collects all chunks, encrypts, and returns a new stream of ciphertext || tag.
     * The iv and tag are NOT embedded in the stream — they are stored in the JWE structure.
     */
    static aeadEncryptStream(algorithm: ContentEncryptionAlgorithm, keyBytes: Uint8Array, iv: Uint8Array, plaintextStream: ReadableStream<Uint8Array>): Promise<{
        ciphertextStream: ReadableStream<Uint8Array>;
        tag: Uint8Array;
    }>;
    /**
     * Decrypts a ciphertext stream using an AEAD cipher.
     * Returns a ReadableStream of plaintext.
     */
    static aeadDecryptStream(algorithm: ContentEncryptionAlgorithm, keyBytes: Uint8Array, iv: Uint8Array, ciphertextStream: ReadableStream<Uint8Array>, tag: Uint8Array): Promise<ReadableStream<Uint8Array>>;
    /**
     * Performs ECDH-ES key agreement with X25519 and wraps the CEK using AES-256 Key Wrap.
     *
     * @param ephemeralPrivateKey - Ephemeral X25519 private key (JWK).
     * @param recipientPublicKey - Recipient's X25519 public key (JWK).
     * @param cek - The Content Encryption Key to wrap.
     * @returns The wrapped CEK bytes.
     */
    static ecdhEsWrapKey(ephemeralPrivateKey: Jwk, recipientPublicKey: Jwk, cek: Uint8Array): Promise<Uint8Array>;
    /**
     * Performs ECDH-ES key agreement with X25519 and unwraps the CEK using AES-256 Key Unwrap.
     *
     * @param recipientPrivateKey - Recipient's X25519 private key (JWK).
     * @param ephemeralPublicKey - Ephemeral X25519 public key from the JWE recipient header (JWK).
     * @param wrappedKey - The wrapped CEK bytes.
     * @returns The unwrapped CEK bytes.
     */
    static ecdhEsUnwrapKey(recipientPrivateKey: Jwk, ephemeralPublicKey: Jwk, wrappedKey: Uint8Array): Promise<Uint8Array>;
    /**
     * Builds a JWE encryption property structure from encryption input.
     * The ciphertext (encrypted record data) is stored separately in the DataStore,
     * so only the key wrapping metadata, IV, and authentication tag are included here.
     *
     * @param encryptionInput - Describes the CEK, IV, and recipient key encryption inputs.
     * @param tag - The authentication tag produced by the AEAD cipher during data encryption.
     */
    static buildJwe(encryptionInput: EncryptionInput, tag: Uint8Array): Promise<JweEncryption>;
    /**
     * Parses the JWE protected header from its base64url encoding.
     */
    static parseProtectedHeader(protectedBase64url: string): JweProtectedHeader;
    /**
     * Reads a ReadableStream to completion and returns all bytes concatenated.
     */
    private static readStream;
}
//# sourceMappingURL=encryption.d.ts.map