/**
 * Key derivation utilities for Neotoma local encryption
 *
 * Derives separate Auth, Data, and Log keys from a single root secret
 * (Ed25519 private key bytes or BIP-39 mnemonic-derived seed) using HKDF.
 *
 * Design decisions (see plan Section 7 - blockchain compatibility):
 * - Auth Key is Ed25519-compatible for future event signing
 * - Data Key encrypts DB column content only (never chain/signature metadata)
 * - Log Key encrypts persistent log entries
 * - Encryption lives in the repository layer; domain code sees plaintext
 */
/**
 * Derived key set from a single root secret
 */
export interface DerivedKeys {
    /** 32-byte key for Ed25519 signing and authentication */
    authKey: Uint8Array;
    /** 32-byte key for AES-256-GCM column/data encryption */
    dataKey: Uint8Array;
    /** 32-byte key for AES-256-GCM log encryption */
    logKey: Uint8Array;
}
/**
 * Auth identity derived from the auth key
 */
export interface AuthIdentity {
    /** Ed25519 private key (seed) for signing */
    privateKey: Uint8Array;
    /** Ed25519 public key for verification */
    publicKey: Uint8Array;
}
/**
 * Derive Auth, Data, and Log keys from raw key material (private key bytes).
 *
 * @param ikm - Input keying material (e.g. 32-byte Ed25519 private key seed)
 * @param salt - Optional salt; if omitted, HKDF uses a zero-filled salt of hash length
 * @returns DerivedKeys with authKey, dataKey, logKey (each 32 bytes)
 */
export declare function deriveKeys(ikm: Uint8Array, salt?: Uint8Array): DerivedKeys;
/**
 * Derive a BIP-39-compatible seed from a mnemonic phrase.
 *
 * Uses PBKDF2-HMAC-SHA512 with 2048 iterations per BIP-39 spec.
 * The resulting 64-byte seed is then used as HKDF input keying material.
 *
 * @param mnemonic - Space-separated mnemonic words (12 or 24 words)
 * @param passphrase - Optional BIP-39 passphrase (default: empty string)
 * @returns 64-byte seed
 */
export declare function mnemonicToSeed(mnemonic: string, passphrase?: string): Uint8Array;
/**
 * Derive keys from a mnemonic phrase.
 *
 * Combines mnemonicToSeed + deriveKeys in one step.
 *
 * @param mnemonic - Space-separated mnemonic words (12 or 24 words)
 * @param passphrase - Optional BIP-39 passphrase
 * @returns DerivedKeys
 */
export declare function deriveKeysFromMnemonic(mnemonic: string, passphrase?: string): DerivedKeys;
/**
 * Derive an Ed25519 signing identity from the auth key.
 *
 * The auth key (32 bytes from HKDF) is used as the Ed25519 seed.
 * This produces a deterministic keypair suitable for authentication
 * and future event signing.
 *
 * @param authKey - 32-byte auth key from deriveKeys()
 * @returns AuthIdentity with privateKey and publicKey
 */
export declare function deriveAuthIdentity(authKey: Uint8Array): AuthIdentity;
/**
 * Derive a static MCP auth token from the same root secret (key file or mnemonic).
 * Used when encryption is enabled: client and server both derive this token;
 * client sends it as Authorization: Bearer <token>, server verifies.
 *
 * @param ikm - Input keying material (same as for deriveKeys: key file bytes or mnemonic seed)
 * @returns 64-char hex string (32 bytes)
 */
export declare function deriveMcpAuthToken(ikm: Uint8Array): string;
/**
 * Convert a 32-byte key to a hex string (for use with Node.js crypto APIs).
 */
export declare function keyToHex(key: Uint8Array): string;
/**
 * Convert a hex string back to Uint8Array.
 */
export declare function hexToKey(hex: string): Uint8Array;
//# sourceMappingURL=key_derivation.d.ts.map