import type { Jwk } from '@enbox/crypto';
import type { PublicKeyJwk } from '../types/jose-types.js';
import { KeyDerivationScheme } from './hd-key.js';
export declare enum ContentEncryptionAlgorithm {
    A256CTR = "A256CTR"
}
export declare enum KeyAgreementAlgorithm {
    X25519HkdfSha256A256Kw = "X25519-HKDF-SHA256+A256KW"
}
export declare const ROLE_AUDIENCE_DERIVATION_SCHEME = "roleAudience";
export type ProtocolPathKeyEncryption = {
    algorithm: KeyAgreementAlgorithm.X25519HkdfSha256A256Kw;
    keyId: string;
    derivationScheme: KeyDerivationScheme.ProtocolPath;
    ephemeralPublicKey: PublicKeyJwk;
    encryptedKey: string;
};
export type RoleAudienceKeyEncryption = {
    algorithm: KeyAgreementAlgorithm.X25519HkdfSha256A256Kw;
    keyId: string;
    derivationScheme: typeof ROLE_AUDIENCE_DERIVATION_SCHEME;
    protocol: string;
    role: string;
    epoch: number;
    ephemeralPublicKey: PublicKeyJwk;
    encryptedKey: string;
};
export type KeyEncryption = ProtocolPathKeyEncryption | RoleAudienceKeyEncryption;
export type X25519KeyEncryption = ProtocolPathKeyEncryption | RoleAudienceKeyEncryption;
export type DwnEncryption = {
    algorithm: ContentEncryptionAlgorithm.A256CTR;
    initializationVector: string;
    keyEncryption: KeyEncryption[];
};
export type ProtocolPathKeyEncryptionInput = {
    keyId: string;
    publicKey: PublicKeyJwk;
    derivationScheme: KeyDerivationScheme.ProtocolPath;
};
export type RoleAudienceKeyEncryptionInput = {
    keyId: string;
    publicKey: PublicKeyJwk;
    derivationScheme: typeof ROLE_AUDIENCE_DERIVATION_SCHEME;
    protocol: string;
    role: string;
    epoch: number;
};
export type KeyEncryptionInput = ProtocolPathKeyEncryptionInput | RoleAudienceKeyEncryptionInput;
export type X25519KeyEncryptionInput = ProtocolPathKeyEncryptionInput | RoleAudienceKeyEncryptionInput;
export type EncryptionInput = {
    algorithm?: ContentEncryptionAlgorithm;
    key: Uint8Array;
    initializationVector: Uint8Array;
    keyEncryptionInputs: KeyEncryptionInput[];
};
export type KeyUnwrapPayload = {
    encryptedKey: Uint8Array;
    ephemeralPublicKey: PublicKeyJwk;
    keyEncryption: KeyEncryption;
};
export declare class Encryption {
    static encrypt(algorithm: ContentEncryptionAlgorithm, keyBytes: Uint8Array, initializationVector: Uint8Array, plaintext: Uint8Array): Promise<Uint8Array>;
    static decrypt(algorithm: ContentEncryptionAlgorithm, keyBytes: Uint8Array, initializationVector: Uint8Array, ciphertext: Uint8Array): Promise<Uint8Array>;
    static encryptStream(algorithm: ContentEncryptionAlgorithm, keyBytes: Uint8Array, initializationVector: Uint8Array, plaintextStream: ReadableStream<Uint8Array>): Promise<ReadableStream<Uint8Array>>;
    static decryptStream(algorithm: ContentEncryptionAlgorithm, keyBytes: Uint8Array, initializationVector: Uint8Array, ciphertextStream: ReadableStream<Uint8Array>): Promise<ReadableStream<Uint8Array>>;
    static wrapKey(recipientPublicKey: PublicKeyJwk, cek: Uint8Array, keyInput: KeyEncryptionInput, ephemeralPrivateKey?: Jwk): Promise<{
        encryptedKey: Uint8Array;
        ephemeralPublicKey: PublicKeyJwk;
    }>;
    private static wrapX25519Key;
    static unwrapKey(recipientPrivateKey: Jwk, keyEncryption: KeyEncryption): Promise<Uint8Array>;
    private static unwrapX25519Key;
    static buildEncryptionProperty(encryptionInput: EncryptionInput): Promise<DwnEncryption>;
    static getKeyId(publicKeyJwk: PublicKeyJwk): Promise<string>;
    static validateEncryptionProperty(encryption: DwnEncryption): void;
    private static buildKeyEncryptionEntry;
    private static validateKeyEncryptionEntry;
    private static validateX25519KeyEncryptionEntry;
    private static deriveKek;
    private static getKekInfo;
    private static validateContentEncryptionParameters;
    private static validateContentEncryptionKey;
    private static validateSharedSecret;
    private static toA256CtrJwk;
    private static readStream;
    private static toStream;
}
//# sourceMappingURL=encryption.d.ts.map