import type { Jwk } from '@enbox/crypto';
import type { PublicKeyJwk } from '../types/jose-types.js';
import { KeyDerivationScheme } from './hd-key.js';
export declare enum ContentEncryptionAlgorithm {
    A256CTR = "A256CTR"
}
export declare enum KeyAgreementAlgorithm {
    X25519HkdfSha256A256Kw = "X25519-HKDF-SHA256+A256KW"
}
export declare const ROLE_AUDIENCE_DERIVATION_SCHEME = "roleAudience";
export declare const SEAL_DERIVATION_SCHEME = "seal";
export type X25519KeyEncryptionBase = {
    algorithm: KeyAgreementAlgorithm.X25519HkdfSha256A256Kw;
    keyId: string;
    ephemeralPublicKey: PublicKeyJwk;
    encryptedKey: string;
};
export type ProtocolPathKeyEncryption = X25519KeyEncryptionBase & {
    derivationScheme: KeyDerivationScheme.ProtocolPath;
};
export type SourceRoleAudienceKeyEncryption = X25519KeyEncryptionBase & {
    derivationScheme: typeof ROLE_AUDIENCE_DERIVATION_SCHEME;
    protocol: string;
    rolePath: string;
};
export type X25519KeyEncryption = ProtocolPathKeyEncryption | SourceRoleAudienceKeyEncryption;
export type SealKeyWrap = X25519KeyEncryptionBase & {
    derivationScheme: typeof SEAL_DERIVATION_SCHEME;
};
export type DwnEncryption = {
    algorithm: ContentEncryptionAlgorithm.A256CTR;
    initializationVector: string;
    keyEncryption: X25519KeyEncryption[];
};
export type X25519KeyEncryptionInputBase = {
    algorithm: KeyAgreementAlgorithm.X25519HkdfSha256A256Kw;
    keyId: string;
    publicKey: PublicKeyJwk;
};
export type ProtocolPathKeyEncryptionInput = X25519KeyEncryptionInputBase & {
    derivationScheme: KeyDerivationScheme.ProtocolPath;
};
export type SourceRoleAudienceKeyEncryptionInput = X25519KeyEncryptionInputBase & {
    derivationScheme: typeof ROLE_AUDIENCE_DERIVATION_SCHEME;
    protocol: string;
    rolePath: string;
};
export type X25519KeyEncryptionInput = ProtocolPathKeyEncryptionInput | SourceRoleAudienceKeyEncryptionInput;
export type SealKeyWrapInput = X25519KeyEncryptionInputBase & {
    derivationScheme: typeof SEAL_DERIVATION_SCHEME;
    protocol: string;
    rolePath: string;
    contextId: string;
    audienceKeyId: string;
};
export type EncryptionInput = {
    algorithm?: ContentEncryptionAlgorithm;
    key: Uint8Array;
    initializationVector: Uint8Array;
    keyEncryptionInputs: X25519KeyEncryptionInput[];
};
export type KeyUnwrapPayload = {
    encryptedKey: Uint8Array;
    ephemeralPublicKey: PublicKeyJwk;
    keyEncryption: X25519KeyEncryption;
};
export type X25519KeyWrapInput = {
    cek: Uint8Array;
    keyInput: X25519KeyEncryptionInput;
    ephemeralPrivateKey?: Jwk;
};
export type SealWrapInput = {
    privateKeyBytes: Uint8Array;
    keyInput: SealKeyWrapInput;
    ephemeralPrivateKey?: Jwk;
};
export type SealUnwrapInput = {
    seal: SealKeyWrap;
    recipientPrivateKey: Jwk;
    protocol: string;
    rolePath: string;
    contextId: string;
    audienceKeyId: string;
};
export declare class Encryption {
    static encrypt(algorithm: ContentEncryptionAlgorithm, keyBytes: Uint8Array, initializationVector: Uint8Array, plaintext: Uint8Array): Promise<Uint8Array>;
    static decrypt(algorithm: ContentEncryptionAlgorithm, keyBytes: Uint8Array, initializationVector: Uint8Array, ciphertext: Uint8Array): Promise<Uint8Array>;
    static encryptStream(algorithm: ContentEncryptionAlgorithm, keyBytes: Uint8Array, initializationVector: Uint8Array, plaintextStream: ReadableStream<Uint8Array>): Promise<ReadableStream<Uint8Array>>;
    static decryptStream(algorithm: ContentEncryptionAlgorithm, keyBytes: Uint8Array, initializationVector: Uint8Array, ciphertextStream: ReadableStream<Uint8Array>): Promise<ReadableStream<Uint8Array>>;
    static wrapKey(input: X25519KeyWrapInput): Promise<{
        encryptedKey: Uint8Array;
        ephemeralPublicKey: PublicKeyJwk;
    }>;
    static wrapSeal(input: SealWrapInput): Promise<SealKeyWrap>;
    private static wrapX25519Key;
    static unwrapKey(recipientPrivateKey: Jwk, keyEncryption: X25519KeyEncryption): Promise<Uint8Array>;
    static unwrapSeal(input: SealUnwrapInput): Promise<Uint8Array>;
    private static unwrapX25519Key;
    static buildEncryptionProperty(encryptionInput: EncryptionInput): Promise<DwnEncryption>;
    static getKeyId(publicKeyJwk: PublicKeyJwk): Promise<string>;
    static validateEncryptionProperty(encryption: DwnEncryption): void;
    private static buildKeyEncryptionEntry;
    private static validateKeyEncryptionEntry;
    private static validateX25519KeyEncryptionEntry;
    private static deriveKek;
    private static getKekInfo;
    private static validateContentEncryptionParameters;
    private static validateContentEncryptionKey;
    private static validateSharedSecret;
    private static isX25519KeyAgreementAlgorithm;
    private static unsupportedKeyAgreementAlgorithmMessage;
    private static toA256CtrJwk;
    private static toA256KwJwk;
    private static readStream;
    private static toStream;
}
//# sourceMappingURL=encryption.d.ts.map