/**
 * Email Encryption Service
 *
 * Provides encryption, decryption, signing, and signature verification
 * for email messages in the BrightChain messaging system.
 *
 * Supports:
 * - ECIES (per-recipient public key encryption via BlockECIES)
 * - Symmetric encryption (AES-256-GCM with a shared key)
 * - S/MIME-style digital signatures (sign with sender's private key, verify with public key)
 *
 * Uses cross-platform crypto utilities (Web Crypto API) so this works
 * in both Node.js and browser environments.
 *
 * @see Requirements 16.1, 16.3, 16.4, 16.5, 16.6, 16.7, 16.8
 */
import { MessageEncryptionScheme } from '../../enumerations/messaging/messageEncryptionScheme';
/**
 * Encryption metadata stored alongside an encrypted email.
 *
 * @see Requirement 16.7 - Store encryption metadata in Email_Metadata
 */
export interface IEmailEncryptionMetadata {
    /** The encryption scheme used */
    scheme: MessageEncryptionScheme;
    /**
     * Per-recipient encrypted symmetric key (base64-encoded).
     * Only present when scheme is RECIPIENT_KEYS.
     * Maps recipient address to their ECIES-encrypted copy of the symmetric key.
     */
    encryptedKeys?: Map<string, Uint8Array>;
    /** Initialization vector used for symmetric encryption (base64) */
    iv?: Uint8Array;
    /** Authentication tag from AES-GCM (base64) */
    authTag?: Uint8Array;
    /** Whether the email is signed */
    isSigned: boolean;
    /** Digital signature bytes (if signed) */
    signature?: Uint8Array;
    /** Public key of the signer (for verification) */
    signerPublicKey?: Uint8Array;
    /**
     * ASCII-armored OpenPGP encrypted message (when scheme=GPG).
     *
     * @see Requirement 3.4
     */
    gpgEncryptedMessage?: string;
    /**
     * Detached GPG signature (ASCII armor, when GPG signing is used).
     *
     * @see Requirement 4.4
     */
    gpgSignature?: string;
    /**
     * Key ID of the GPG signer.
     *
     * @see Requirement 3.3
     */
    gpgSignerKeyId?: string;
    /**
     * CMS/PKCS#7 encrypted content (when scheme=S_MIME, real CMS).
     *
     * @see Requirement 7.3
     */
    cmsEncryptedContent?: Uint8Array;
    /**
     * CMS detached signature (when S/MIME signing is used).
     *
     * @see Requirement 8.4
     */
    cmsSignature?: Uint8Array;
    /**
     * Subject of the S/MIME signer certificate.
     *
     * @see Requirement 8.4
     */
    smimeSignerSubject?: string;
}
/**
 * Result of encrypting email content for a single recipient.
 */
export interface IEncryptedEmailContent {
    /** The encrypted content bytes */
    encryptedContent: Uint8Array;
    /** Encryption metadata for this recipient */
    encryptionMetadata: IEmailEncryptionMetadata;
}
/**
 * Result of encrypting email content for multiple recipients.
 */
export interface IPerRecipientEncryptionResult {
    /**
     * The encrypted content (encrypted once with a symmetric key).
     * All recipients share the same ciphertext; each gets the symmetric key
     * encrypted with their own public key.
     */
    encryptedContent: Uint8Array;
    /** Encryption metadata including per-recipient encrypted keys */
    encryptionMetadata: IEmailEncryptionMetadata;
}
/**
 * Result of signing email content.
 */
export interface ISignatureResult {
    /** The digital signature bytes */
    signature: Uint8Array;
    /** The public key of the signer */
    signerPublicKey: Uint8Array;
}
/**
 * Service for encrypting and decrypting email content.
 *
 * Encryption flow (ECIES / RECIPIENT_KEYS):
 * 1. Generate a random AES-256-GCM symmetric key
 * 2. Encrypt the email content with the symmetric key
 * 3. Encrypt the symmetric key with each recipient's ECIES public key
 * 4. Store the encrypted content + per-recipient encrypted keys
 *
 * Encryption flow (SYMMETRIC / SHARED_KEY):
 * 1. Use the provided shared symmetric key directly
 * 2. Encrypt the email content with AES-256-GCM
 *
 * @see Requirements 16.1, 16.3, 16.4, 16.5, 16.6, 16.7, 16.8
 */
export declare class EmailEncryptionService {
    private _gpgKeyManager?;
    private _smimeCertificateManager?;
    private getGpgKeyManager;
    private getSmimeCertificateManager;
    /**
     * Encrypts email content using ECIES for a single recipient.
     *
     * Generates a random AES-256-GCM key, encrypts the content, then
     * encrypts the symmetric key with the recipient's ECIES public key.
     *
     * @param content - Plaintext email content
     * @param recipientPublicKey - Recipient's ECIES public key
     * @returns Encrypted content and encryption metadata
     * @throws {EmailError} If encryption fails
     *
     * @see Requirement 16.1 - End-to-end encryption using ECIES
     * @see Requirement 16.3 - Encrypt content blocks using recipient's public key
     */
    encryptContent(content: Uint8Array, recipientPublicKey: Uint8Array): Promise<IEncryptedEmailContent>;
    /**
     * Encrypts email content using a shared symmetric key (AES-256-GCM).
     *
     * @param content - Plaintext email content
     * @param sharedKey - 32-byte shared symmetric key
     * @returns Encrypted content and encryption metadata
     * @throws {EmailError} If encryption fails
     *
     * @see Requirement 16.1 - Support SYMMETRIC encryption scheme
     */
    encryptContentSymmetric(content: Uint8Array, sharedKey: Uint8Array): Promise<IEncryptedEmailContent>;
    /**
     * Decrypts email content encrypted with ECIES (RECIPIENT_KEYS scheme).
     *
     * 1. Decrypts the per-recipient symmetric key using the recipient's private key
     * 2. Decrypts the content using the recovered symmetric key
     *
     * @param encryptedContent - The encrypted email content
     * @param metadata - Encryption metadata containing the encrypted key, IV, and auth tag
     * @param recipientAddress - The recipient's address (key in encryptedKeys map)
     * @param recipientPrivateKey - The recipient's ECIES private key
     * @returns Decrypted plaintext content
     * @throws {EmailError} If decryption fails
     */
    decryptContent(encryptedContent: Uint8Array, metadata: IEmailEncryptionMetadata, recipientAddress: string, recipientPrivateKey: Uint8Array): Promise<Uint8Array>;
    /**
     * Decrypts email content encrypted with a shared symmetric key.
     *
     * @param encryptedContent - The encrypted email content
     * @param metadata - Encryption metadata containing IV and auth tag
     * @param sharedKey - The 32-byte shared symmetric key
     * @returns Decrypted plaintext content
     * @throws {EmailError} If decryption fails
     */
    decryptContentSymmetric(encryptedContent: Uint8Array, metadata: IEmailEncryptionMetadata, sharedKey: Uint8Array): Promise<Uint8Array>;
    /**
     * Encrypts email content for multiple recipients.
     *
     * Generates a single symmetric key, encrypts the content once,
     * then encrypts the symmetric key separately for each recipient
     * using their ECIES public key.
     *
     * @param content - Plaintext email content
     * @param recipientPublicKeys - Map of recipient address to their ECIES public key
     * @returns Encrypted content and per-recipient encryption metadata
     * @throws {EmailError} If encryption fails for any recipient
     *
     * @see Requirement 16.4 - Create separate encrypted copies for each recipient
     * @see Requirement 16.7 - Store encryption metadata in Email_Metadata
     */
    encryptForRecipients(content: Uint8Array, recipientPublicKeys: Map<string, Uint8Array>): Promise<IPerRecipientEncryptionResult>;
    /**
     * Signs email content with the sender's private key.
     *
     * Creates a SHA-256 hash of the content and encrypts it with the
     * sender's private key using ECIES to produce a digital signature.
     * The signature can be verified by anyone with the sender's public key.
     *
     * @param content - The email content to sign
     * @param senderPrivateKey - The sender's ECIES private key
     * @param senderPublicKey - The sender's ECIES public key (stored with signature)
     * @returns The signature and signer's public key
     * @throws {EmailError} If signing fails
     *
     * @see Requirement 16.5 - S/MIME signatures for sender authentication
     */
    signContent(content: Uint8Array, senderPrivateKey: Uint8Array, senderPublicKey: Uint8Array): Promise<ISignatureResult>;
    /**
     * Verifies a digital signature on email content.
     *
     * Recomputes the signature using the provided private key and compares
     * it to the stored signature. In a production S/MIME implementation,
     * this would use ECDSA verification with only the public key.
     *
     * @param content - The email content that was signed
     * @param signature - The signature to verify
     * @param signerPrivateKey - The signer's private key (needed for HMAC verification)
     * @returns true if the signature is valid
     *
     * @see Requirement 16.8 - Verify sender's signature on decryption
     */
    verifySignature(content: Uint8Array, signature: Uint8Array, signerPrivateKey: Uint8Array): Promise<boolean>;
    /**
     * Encrypts and signs email content for multiple recipients.
     *
     * Combines per-recipient encryption with digital signing:
     * 1. Signs the plaintext content with the sender's private key
     * 2. Encrypts the content for all recipients
     * 3. Returns encrypted content with signature metadata
     *
     * @param content - Plaintext email content
     * @param recipientPublicKeys - Map of recipient address to ECIES public key
     * @param senderPrivateKey - Sender's private key for signing
     * @param senderPublicKey - Sender's public key (stored with signature)
     * @returns Encrypted content with signature metadata
     *
     * @see Requirements 16.4, 16.5
     */
    encryptAndSign(content: Uint8Array, recipientPublicKeys: Map<string, Uint8Array>, senderPrivateKey: Uint8Array, senderPublicKey: Uint8Array): Promise<IPerRecipientEncryptionResult>;
    /**
     * Decrypts email content and verifies the sender's signature.
     *
     * @param encryptedContent - The encrypted email content
     * @param metadata - Encryption metadata with signature info
     * @param recipientAddress - The recipient's address
     * @param recipientPrivateKey - The recipient's private key for decryption
     * @param signerPrivateKey - The signer's private key for HMAC verification
     * @returns Decrypted content
     * @throws {EmailError} If decryption or signature verification fails
     *
     * @see Requirement 16.8 - Verify sender's signature on decryption
     */
    decryptAndVerify(encryptedContent: Uint8Array, metadata: IEmailEncryptionMetadata, recipientAddress: string, recipientPrivateKey: Uint8Array, signerPrivateKey: Uint8Array): Promise<Uint8Array>;
    /**
     * Encrypts email content using S/MIME-style encryption.
     *
     * S/MIME encryption combines signing and per-recipient encryption:
     * 1. Signs the content with the sender's private key
     * 2. Encrypts the signed content for each recipient using ECIES
     *
     * This is equivalent to `encryptAndSign` but explicitly sets the
     * scheme to S_MIME for metadata tracking.
     *
     * @param content - Plaintext email content
     * @param recipientPublicKeys - Map of recipient address to ECIES public key
     * @param senderPrivateKey - Sender's private key for signing
     * @param senderPublicKey - Sender's public key (stored with signature)
     * @returns Encrypted content with S/MIME metadata
     *
     * @see Requirement 16.6 - S/MIME encryption as alternative method
     */
    encryptSmime(content: Uint8Array, recipientPublicKeys: Map<string, Uint8Array>, senderPrivateKey: Uint8Array, senderPublicKey: Uint8Array): Promise<IPerRecipientEncryptionResult>;
    /**
     * Decrypts S/MIME encrypted email content and verifies the signature.
     *
     * @param encryptedContent - The encrypted email content
     * @param metadata - Encryption metadata with S/MIME info
     * @param recipientAddress - The recipient's address
     * @param recipientPrivateKey - The recipient's private key for decryption
     * @param signerPrivateKey - The signer's private key for HMAC verification
     * @returns Decrypted content
     * @throws {EmailError} If decryption or signature verification fails
     *
     * @see Requirement 16.6 - S/MIME encryption
     * @see Requirement 16.8 - Verify sender's signature on decryption
     */
    decryptSmime(encryptedContent: Uint8Array, metadata: IEmailEncryptionMetadata, recipientAddress: string, recipientPrivateKey: Uint8Array, signerPrivateKey: Uint8Array): Promise<Uint8Array>;
    /**
     * Encrypts email content using OpenPGP for multiple recipients.
     *
     * Delegates to GpgKeyManager.encrypt() and wraps the result in
     * IPerRecipientEncryptionResult with scheme set to GPG.
     * Optionally signs the content before encryption if sender key is provided.
     *
     * @param content - Plaintext email content
     * @param recipientPublicKeysArmored - Map of recipient email to ASCII-armored GPG public key
     * @param senderPrivateKeyArmored - Optional sender's GPG private key for signing
     * @param senderPassphrase - Optional passphrase for the sender's private key
     * @returns Encrypted content and GPG metadata
     * @throws {EmailError} PRIVATE_KEY_MISSING if signing requested but key missing
     * @throws {EmailError} GPG_ENCRYPT_FAILED on encryption failure
     *
     * @see Requirements 3.1, 3.3, 3.4, 14.1
     */
    encryptGpg(content: Uint8Array, recipientPublicKeysArmored: Map<string, string>, senderPrivateKeyArmored?: string, senderPassphrase?: string): Promise<IPerRecipientEncryptionResult>;
    /**
     * Decrypts an OpenPGP encrypted message using a GPG private key.
     *
     * Delegates to GpgKeyManager.decrypt(). The encryptedContent is expected
     * to be the UTF-8 encoded ASCII-armored OpenPGP message.
     *
     * @param encryptedContent - The encrypted content (UTF-8 encoded armored message)
     * @param privateKeyArmored - ASCII-armored GPG private key
     * @param passphrase - Passphrase to unlock the private key
     * @returns Decrypted plaintext content
     * @throws {EmailError} PRIVATE_KEY_MISSING if private key is not provided
     * @throws {EmailError} GPG_DECRYPT_FAILED on decryption failure
     *
     * @see Requirements 5.1, 5.5
     */
    decryptGpg(encryptedContent: Uint8Array, privateKeyArmored: string, passphrase: string): Promise<Uint8Array>;
    /**
     * Signs email content with a GPG private key (detached signature).
     *
     * Delegates to GpgKeyManager.sign() and adapts the result to ISignatureResult.
     *
     * @param content - The email content to sign
     * @param privateKeyArmored - ASCII-armored GPG private key
     * @param passphrase - Passphrase to unlock the private key
     * @returns Signature result with signature bytes and signer public key placeholder
     * @throws {EmailError} PRIVATE_KEY_MISSING if private key is not provided
     * @throws {EmailError} GPG_VERIFY_FAILED on signing failure
     *
     * @see Requirements 4.1, 4.2
     */
    signGpg(content: Uint8Array, privateKeyArmored: string, passphrase: string): Promise<ISignatureResult>;
    /**
     * Verifies a GPG detached signature against the given content.
     *
     * Delegates to GpgKeyManager.verify() and returns a boolean.
     *
     * @param content - The email content that was signed
     * @param signature - The detached signature bytes (UTF-8 encoded armored signature)
     * @param signerPublicKeyArmored - ASCII-armored GPG public key of the expected signer
     * @returns true if the signature is valid, false otherwise
     *
     * @see Requirements 5.2, 5.3, 5.4
     */
    verifyGpg(content: Uint8Array, signature: Uint8Array, signerPublicKeyArmored: string): Promise<boolean>;
    /**
     * Encrypts email content using real CMS/PKCS#7 enveloped-data for multiple recipients.
     *
     * Delegates to SmimeCertificateManager.encrypt() for RFC 5751 CMS encryption.
     * Optionally signs the content before encryption if sender cert+key are provided.
     *
     * @param content - Plaintext email content
     * @param recipientCertificatesPem - Map of recipient email to PEM-encoded X.509 certificate
     * @param senderCertPem - Optional sender's S/MIME certificate PEM for signing
     * @param senderPrivateKeyPem - Optional sender's S/MIME private key PEM for signing
     * @returns Encrypted content and S/MIME metadata
     * @throws {EmailError} PRIVATE_KEY_MISSING if signing requested but key missing
     * @throws {EmailError} SMIME_ENCRYPT_FAILED on encryption failure
     *
     * @see Requirements 7.1, 7.3, 7.4, 8.2
     */
    encryptSmimeReal(content: Uint8Array, recipientCertificatesPem: Map<string, string>, senderCertPem?: string, senderPrivateKeyPem?: string): Promise<IPerRecipientEncryptionResult>;
    /**
     * Decrypts CMS/PKCS#7 enveloped-data content using a recipient's certificate and private key.
     *
     * Delegates to SmimeCertificateManager.decrypt() for RFC 5751 CMS decryption.
     *
     * @param encryptedContent - DER-encoded CMS/PKCS#7 enveloped-data
     * @param certificatePem - PEM-encoded X.509 certificate of the recipient
     * @param privateKeyPem - PEM-encoded PKCS#8 private key of the recipient
     * @returns Decrypted plaintext content
     * @throws {EmailError} PRIVATE_KEY_MISSING if private key is not provided
     * @throws {EmailError} SMIME_DECRYPT_FAILED on decryption failure
     *
     * @see Requirements 9.1, 9.5
     */
    decryptSmimeReal(encryptedContent: Uint8Array, certificatePem: string, privateKeyPem: string): Promise<Uint8Array>;
    /**
     * Signs email content with an S/MIME certificate and private key (CMS detached signature).
     *
     * Delegates to SmimeCertificateManager.sign() and adapts the result to ISignatureResult.
     *
     * @param content - The email content to sign
     * @param certificatePem - PEM-encoded X.509 certificate of the signer
     * @param privateKeyPem - PEM-encoded PKCS#8 private key of the signer
     * @returns Signature result with CMS signature bytes and signer public key (encoded subject)
     * @throws {EmailError} PRIVATE_KEY_MISSING if private key is not provided
     * @throws {EmailError} SMIME_VERIFY_FAILED on signing failure
     *
     * @see Requirements 8.1, 8.4
     */
    signSmime(content: Uint8Array, certificatePem: string, privateKeyPem: string): Promise<ISignatureResult>;
    /**
     * Verifies an S/MIME CMS detached signature against the given content.
     *
     * Delegates to SmimeCertificateManager.verify() and returns a boolean.
     *
     * @param content - The email content that was signed
     * @param signature - The DER-encoded CMS detached signature
     * @param signerCertificatePem - PEM-encoded X.509 certificate of the expected signer
     * @returns true if the signature is valid, false otherwise
     *
     * @see Requirements 9.2, 9.3, 9.4
     */
    verifySmime(content: Uint8Array, signature: Uint8Array, signerCertificatePem: string): Promise<boolean>;
}
//# sourceMappingURL=emailEncryptionService.d.ts.map