import { memoryKeyStore, type KeyStore } from './keystore.js';
export interface Recipient {
    /** base64url. This is what goes in the URL fragment. */
    readonly publicKey: string;
    /** base64url of the four-byte id, for matching a stored item to this device. */
    readonly keyId: string;
    /**
     * Unseals bytes.
     *
     * Bytes that were never sealed are returned unchanged, so this is safe to
     * point at an entire queue during a rollout, or after turning encryption off.
     */
    decrypt(data: Uint8Array | ArrayBuffer | Blob): Promise<Uint8Array>;
    decryptText(text: string): Promise<string>;
    /**
     * Whether this device can unseal these bytes, without attempting it.
     *
     * For a list view: it distinguishes "sealed to a key this device no longer
     * has" from "corrupt", which are different things to tell a requester.
     */
    canDecrypt(data: Uint8Array): {
        ok: true;
    } | {
        ok: false;
        reason: 'wrong-key' | 'corrupt';
    };
}
export interface RecipientOptions {
    /**
     * Which key this is. One per tenant or room — a device that serves two
     * of them under separate credentials should not share one key between them.
     */
    scope?: string;
    /** Defaults to IndexedDB in a browser, and throws where there is none. */
    store?: KeyStore;
}
/**
 * The requester's side: loads this device's keypair, or makes one.
 *
 * The private half is generated non-extractable and stored as a `CryptoKey`
 * handle — it never exists as bytes in JavaScript. See `derive.ts` for why that
 * matters and `keystore.ts` for exactly how long it survives, which is the part
 * worth reading before enabling any of this.
 *
 * There is deliberately no export, backup or escrow. Any of them would require
 * an extractable key, which is the property this is built on.
 */
export declare function createRecipient(options?: RecipientOptions): Promise<Recipient>;
export { memoryKeyStore };
//# sourceMappingURL=recipient.d.ts.map