/**
 * ECDH Key Envelope — encrypted API key exchange.
 *
 * Crypto chain:
 *   secp256k1 ECDH → x-coordinate → HKDF(sha256, x, nonce, "j41-key-envelope-v1", 32) → AES-256-GCM
 *
 * All crypto uses @noble/secp256k1 + @noble/hashes (already in dependency tree
 * via @bitgo/utxo-lib) and Node.js built-in crypto for AES-GCM.
 */
import type { AccessRequest, AccessEnvelope, AccessPayload } from './types.js';
export type { AccessRequest, AccessEnvelope, AccessPayload } from './types.js';
/**
 * Options for access-request/envelope verification.
 *
 * The SDK is stateless, so durable replay protection (a seen-nonce store) must
 * be supplied by the caller via `isReplay` — e.g. the dispatcher's nonce-cache.
 */
export interface AccessVerifyOptions {
    /** Max age (seconds) for the signed timestamp. Default 300. */
    maxAgeSeconds?: number;
    /** Current time as unix seconds (override for testing). */
    now?: number;
    /**
     * Replay guard. Called with the request nonce AFTER the signature checks out;
     * return true if the nonce has been seen before (verification then fails).
     * Implementations typically check-and-record in one call.
     */
    isReplay?: (nonce: string) => boolean | Promise<boolean>;
}
/**
 * Generate an ephemeral secp256k1 keypair for ECDH key exchange.
 * The private key should be used ONCE and then discarded.
 */
export declare function generateEphemeralKeypair(): {
    privateKey: Uint8Array;
    publicKey: Uint8Array;
};
/**
 * Build a signed access request (buyer side).
 *
 * The returned `nonce` MUST be retained by the caller — it is needed to
 * decrypt the response envelope via `openAccessEnvelope(envelope, ephPriv, request.nonce)`.
 *
 * @param buyerWif - Buyer's WIF private key (for signing)
 * @param sellerVerusId - Seller's VerusID (e.g. "iSeller..." or "seller.agentplatform@")
 * @param ephPub - Ephemeral public key from generateEphemeralKeypair()
 * @param network - 'verus' or 'verustest' (default: 'verustest')
 */
export declare function buildAccessRequest(buyerWif: string, sellerVerusId: string, ephPub: Uint8Array, network?: 'verus' | 'verustest'): AccessRequest;
/**
 * Mint an encrypted access envelope (dispatcher/seller side).
 *
 * Performs ECDH with the buyer's ephemeral public key, derives an AES key
 * via HKDF, encrypts the payload, and signs the FULL envelope (ciphertext + iv + authTag).
 *
 * @param request - The buyer's AccessRequest
 * @param dispatcherWif - Dispatcher's WIF private key (for ECDH + signing)
 * @param payload - The AccessPayload to encrypt (contains the API key)
 * @param network - 'verus' or 'verustest'
 */
export declare function mintAccessEnvelope(request: AccessRequest, dispatcherWif: string, payload: AccessPayload, network?: 'verus' | 'verustest'): AccessEnvelope;
/**
 * Open an encrypted access envelope (buyer side).
 *
 * Uses the buyer's ephemeral private key to derive the same ECDH shared
 * secret, then decrypts the AES-256-GCM payload.
 *
 * @param envelope - The AccessEnvelope from the dispatcher
 * @param ephPrivKey - Buyer's ephemeral private key (from generateEphemeralKeypair)
 * @param nonce - The nonce from the original AccessRequest (hex, 32 chars / 16 bytes).
 *               MUST be the same nonce returned by buildAccessRequest().
 */
export declare function openAccessEnvelope(envelope: AccessEnvelope, ephPrivKey: Uint8Array, nonce: string): AccessPayload;
/**
 * Verify an access envelope's dispatcher signature.
 * Resolves the seller's R-address via J41 platform API, then verifies
 * the signature using bitcoinjs-message.
 *
 * @param envelope - The AccessEnvelope to verify
 * @param client - An authenticated J41Client (or any object with getAgent method)
 * @param sellerVerusId - The seller's VerusID to verify against
 * @param network - 'verus' or 'verustest'
 * @returns true if signature is valid, false otherwise
 */
export declare function verifyAccessEnvelope(envelope: AccessEnvelope, client: {
    getAgent(verusId: string): Promise<any>;
    getIdentityKeys?(idOrName: string): Promise<{
        primaryAddresses?: string[];
        minimumSignatures?: number;
    }>;
}, sellerVerusId: string, network?: 'verus' | 'verustest', opts?: AccessVerifyOptions): Promise<boolean>;
/**
 * Verify an access request's buyer signature.
 * Resolves the buyer's R-address via J41 platform API, then verifies
 * the signature using bitcoinjs-message.
 *
 * Used by the dispatcher to verify the buyer is who they claim to be
 * before minting an API key.
 *
 * @param request - The AccessRequest to verify
 * @param client - An authenticated J41Client (or any object with getAgent method)
 * @param network - 'verus' or 'verustest'
 * @returns true if signature is valid, false otherwise
 */
export declare function verifyAccessRequest(request: AccessRequest, client: {
    getAgent(verusId: string): Promise<any>;
    getIdentityKeys?(idOrName: string): Promise<{
        primaryAddresses?: string[];
        minimumSignatures?: number;
    }>;
}, network?: 'verus' | 'verustest', opts?: AccessVerifyOptions): Promise<boolean>;
//# sourceMappingURL=envelope.d.ts.map