/**
 * Generate an X25519 key pair for a run.
 *
 * @returns publicKey and privateKey as DER-encoded Buffers
 */
export declare function generateRunKeyPair(): {
    publicKey: Buffer;
    privateKey: Buffer;
};
/**
 * Encrypt a run's private key using the orchestrator secret key (KICI_SECRET_KEY).
 *
 * @param privateKey - DER-encoded private key Buffer
 * @param secretKey - Orchestrator secret key (hex or base64 string)
 * @returns Base64-encoded encrypted data (IV || AuthTag || Ciphertext)
 */
export declare function encryptPrivateKey(privateKey: Buffer, secretKey: string): string;
/**
 * Decrypt a run's private key using the orchestrator secret key (KICI_SECRET_KEY).
 *
 * @param encryptedData - Base64-encoded encrypted private key
 * @param secretKey - Orchestrator secret key (hex or base64 string)
 * @returns DER-encoded private key Buffer
 * @throws If decryption fails
 */
export declare function decryptPrivateKey(encryptedData: string, secretKey: string): Buffer;
/**
 * Decrypt a secret output envelope produced by an agent.
 *
 * The agent encrypts with:
 * 1. Generate ephemeral X25519 key pair
 * 2. ECDH: shared secret = agentPrivateKey x runPublicKey
 * 3. HKDF(sha256, sharedSecret, salt='', info='kici-run-secret-outputs', 32)
 * 4. AES-256-GCM encrypt with derived key
 *
 * We decrypt with:
 * 1. ECDH: shared secret = runPrivateKey x agentPublicKey
 * 2. Same HKDF derivation
 * 3. AES-256-GCM decrypt
 *
 * @param envelope - { agentPublicKey: base64, encrypted: base64 (IV||AuthTag||Ciphertext) }
 * @param runPrivateKeyDer - DER-encoded run private key Buffer
 * @returns Decrypted plaintext string
 */
export declare function decryptSecretOutput(envelope: {
    agentPublicKey: string;
    encrypted: string;
}, runPrivateKeyDer: Buffer): string;
//# sourceMappingURL=ephemeral-keys.d.ts.map