export interface CmkWrap {
    readonly recipient: string;
    readonly alg: "x25519-hkdf-sha256-aead";
    readonly ephemeral_public: string;
    readonly wrap_nonce: string;
    readonly wrapped_key: string;
}
/** The CMK envelope stored on a collection. */
export interface CmkEnvelope {
    readonly alg: string;
    readonly wraps: CmkWrap[];
}
/**
 * Derive a 32-byte X25519 private key from an Ed25519 seed via SHA-512
 * truncation + clamping (libsodium crypto_sign_ed25519_sk_to_curve25519).
 */
export declare function ed25519SeedToX25519PrivateKey(seed: Uint8Array): Uint8Array;
export declare function ed25519SeedToX25519PublicKey(seed: Uint8Array): Uint8Array;
export declare function wrapCmkForRecipient(args: {
    cmk: Uint8Array;
    recipientPublicKey: Uint8Array;
    recipientDidUrl: string;
    collectionUrn: string;
}): CmkWrap;
/**
 * Try to unwrap the CMK from `wrap` with `privateKey`. Returns the CMK bytes
 * on success, or `null` when the AEAD tag fails (wrong key / AAD mismatch) —
 * the migration relies on this null-return to AUTO-DISCOVER which legacy sphere
 * seed sealed the wrap (try each, the right one verifies).
 */
export declare function tryUnwrapCmk(args: {
    wrap: {
        recipient: string;
        ephemeral_public: string;
        wrap_nonce: string;
        wrapped_key: string;
    };
    collectionUrn: string;
    privateKey: Uint8Array;
}): Uint8Array | null;
//# sourceMappingURL=cmk-wrap.d.ts.map