import { JweGeneralJson, Recipient } from "../jwe/types.mjs";

//#region src/recipient/index.d.ts

declare class RecipientNotInWallet extends Error {
  constructor(message: string);
}
declare class PeerKeyLookupFailed extends Error {
  constructor(message: string);
}
/** `(kid) -> 32-byte X25519 priv` or `null` if the wallet doesn't hold it. */
type WalletPrivLookup = (kid: string) => Promise<Uint8Array | null | undefined>;
/** `(connection_id) -> (kid, 32-byte X25519 pub)` for the peer. */
type PeerPubLookup = (connectionId: string) => Promise<{
  kid: string;
  publicKey: Uint8Array;
}>;
/**
 * Walk `jwe.recipients[]` for a key the wallet holds. First match
 * wins — multi-recipient JWEs can address the same wallet under
 * multiple kids (key rotation, did:peer rotation) and any match
 * decrypts the same CEK because the bulk body is shared.
 */
declare function findDecryptionKey(args: {
  jwe: JweGeneralJson;
  walletLookup: WalletPrivLookup;
}): Promise<{
  kid: string;
  privateKey: Uint8Array;
}>;
/**
 * Resolve the peer's static X25519 KeyAgreement key into a
 * `Recipient`. The peer's pub key was published in their DID Document
 * at connection setup; we just look it up.
 *
 * Defaults to `alg: ECDH-ES`. Pass `alg` to use pq-hybrid later.
 */
declare function resolveRecipientForConnection(args: {
  connectionId: string;
  peerLookup: PeerPubLookup;
  alg?: string;
}): Promise<Recipient>;
//#endregion
export { PeerKeyLookupFailed, PeerPubLookup, RecipientNotInWallet, WalletPrivLookup, findDecryptionKey, resolveRecipientForConnection };
//# sourceMappingURL=index.d.mts.map