import EncryptionError from '../../domain/errors/EncryptionError.ts';
export type CasContentEncryptionScheme = 'whole' | 'framed' | 'convergent';
export interface CasVaultResolutionWitness {
    readonly vaultSlug: string;
    readonly keyId: string;
    readonly verification: 'verified' | 'failed-passphrase' | 'missing-metadata';
    readonly rotationEpoch: number;
    readonly encryptionCount: number;
    readonly encryptionCountLimit: number;
    readonly privacyMode: boolean;
}
export interface CasResolvedVaultKeyOptions {
    readonly encryptionKey: Uint8Array;
    readonly scheme: string;
    readonly vault: CasVaultResolutionWitness;
    readonly frameBytes?: number;
}
export interface CasContentEncryptionDiagnostics {
    readonly vaultSlug: string;
    readonly keyId: string;
    readonly rotationEpoch: number;
    readonly encryptionCount: number;
    readonly encryptionCountLimit: number;
    readonly privacyMode: boolean;
}
export interface CasStoreEncryptionOptions {
    readonly scheme: CasContentEncryptionScheme;
    readonly frameBytes?: number;
    readonly convergent?: boolean;
}
export interface CasStoreEncryptionArguments {
    readonly encryptionKey?: Uint8Array;
    readonly encryption?: CasStoreEncryptionOptions;
}
export interface CasRestoreEncryptionArguments {
    readonly encryptionKey?: Uint8Array;
}
interface InternalResolvedKeyOptions {
    readonly encryptionKey: Uint8Array;
    readonly scheme?: string;
    readonly frameBytes?: number;
}
export default class CasContentEncryptionPolicy {
    private readonly _enabled;
    private readonly _encryptionKey;
    private readonly _scheme;
    private readonly _frameBytes;
    private readonly _diagnostics;
    private constructor();
    static disabled(): CasContentEncryptionPolicy;
    static fromResolvedVaultKey(options: CasResolvedVaultKeyOptions): CasContentEncryptionPolicy;
    /** @internal Raw keys may only enter here after a caller-owned boundary resolved them. */
    static fromInternalResolvedKey(options: InternalResolvedKeyOptions): CasContentEncryptionPolicy;
    get enabled(): boolean;
    get scheme(): CasContentEncryptionScheme | null;
    vaultDiagnostics(): CasContentEncryptionDiagnostics | null;
    toStoreOptions(): CasStoreEncryptionArguments;
    toRestoreOptions(): CasRestoreEncryptionArguments;
    private _copyKey;
    private _storeEncryptionOptions;
    private _requireScheme;
}
export declare function mapCasContentEncryptionError(error: unknown, surface: string): EncryptionError | null;
export {};
