import { type Sphere } from "./did.js";
import { type Identity, type DidDocument } from "./identity.js";
import { type Author } from "./author.js";
import { type EncDekV04, type KeyRingWrapV04, type ManifestV04, type TitleCipherV2 } from "./bundle-v04.js";
export interface ZoneKeyV04 {
    kid: string;
    /** 32-byte XChaCha20-Poly1305 key. Caller owns zeroization. */
    key: Uint8Array;
}
export declare function generateZoneKeyV04(): ZoneKeyV04;
/** Seal the zone key to one recipient — §3.6 wrap over jcs({kid, zone_key}). */
export declare function sealZoneKeyV04(zk: ZoneKeyV04, recipientLabel: string, recipientKexPk: Uint8Array): KeyRingWrapV04;
/** Open a keyring wrap with my X25519 secret → {kid, key}. Throws on mismatch. */
export declare function openZoneKeyV04(entry: KeyRingWrapV04, myKexSk: Uint8Array): ZoneKeyV04;
export declare function encryptDekV04(zk: ZoneKeyV04, dek: Uint8Array, subjectDid: string, zone: Sphere, sectionId: string): EncDekV04;
/** Throws when the AAD/kid/key don't match (tamper or wrong zone key). */
export declare function decryptDekV04(zoneKey: Uint8Array, encDek: EncDekV04, subjectDid: string, zone: Sphere, sectionId: string): Uint8Array;
export declare function encryptTitleV2(dek: Uint8Array, subjectDid: string, sectionId: string, title: {
    title: string;
    tags?: string[];
}): TitleCipherV2;
export declare function decryptTitleV2(dek: Uint8Array, subjectDid: string, sectionId: string, tc: TitleCipherV2): {
    title: string;
    tags?: string[];
};
export declare function signManifestV04(subject: Identity | Author, m: ManifestV04): ManifestV04;
export interface VerifyV04SignatureOpts {
    resolveDelegatePubkey?: (keyId: string, mandateId: string) => Uint8Array;
}
export declare function verifyManifestSignatureV04(m: ManifestV04, didDoc: DidDocument, opts?: VerifyV04SignatureOpts): {
    ok: boolean;
    error?: string;
};