import { SessionManager } from '../core/session-manager';
import { KeyCustody, KeyStorageAdapter, SecureIdentityProvider } from '../core/types';
export declare class CryptoService {
    private readonly sessionManager;
    private readonly identity;
    /**
     * Accepts either an identity provider or, for compatibility, the storage
     * adapter it used to take. Passing storage keeps the previous behaviour
     * exactly, by wrapping it in the tweetnacl provider.
     */
    constructor(storageOrIdentity: KeyStorageAdapter | SecureIdentityProvider, sessionManager: SessionManager);
    /** How the identity private key is held. See {@link KeyCustody}. */
    get keyCustody(): KeyCustody;
    generateIdentity(): Promise<{
        publicKey: string;
    }>;
    getOrCreateIdentity(): Promise<{
        publicKey: string;
    }>;
    deriveSharedSecret(peerUserId: string, peerPublicKeyBase64: string, localUserId: string): Promise<CryptoKey>;
    encrypt(plaintext: string, symmetricKey: CryptoKey, aadContext: {
        messageId: string;
        senderId: string;
        recipientId: string;
        timestamp: number;
    }): Promise<Uint8Array>;
    decrypt(encryptedPayload: Uint8Array, symmetricKey: CryptoKey, aadContext: {
        messageId: string;
        senderId: string;
        recipientId: string;
        timestamp: number;
    }): Promise<string>;
    private buildAad;
}