import { KeyCustody, KeyStorageAdapter, SecureIdentityProvider } from '../core/types';
/**
 * The original identity path, unchanged in behaviour and kept as the default.
 *
 * tweetnacl needs the private key as bytes, so this reports `software` custody:
 * whatever the configured {@link KeyStorageAdapter} does, the key is reachable
 * from script at derive time. That is not a flaw in this class, it is what using
 * tweetnacl means, and saying so plainly is the point of `keyCustody`.
 *
 * It stays the default because every existing consumer already has keys in this
 * format, and silently moving them would change which messages they can read.
 * Opting into {@link WebCryptoIdentityProvider} is a decision an application
 * makes, not one the SDK makes for it.
 */
export declare class NaclIdentityProvider implements SecureIdentityProvider {
    private readonly storage;
    readonly keyCustody: KeyCustody;
    constructor(storage: KeyStorageAdapter);
    getPublicKey(): Promise<string>;
    deriveMessageKey(params: {
        peerPublicKey: string;
        salt: Uint8Array;
        info: Uint8Array;
    }): Promise<CryptoKey>;
}