import { type KeyringGrant, type SealedBox, type SignedKeyringGrant } from "../schemas/keyring.js";
export interface KeyringKeyPair {
    readonly publicKey: string;
    readonly privateKey: string;
}
export declare const newSealKeyPair: () => KeyringKeyPair;
export declare const newSignKeyPair: () => KeyringKeyPair;
export type SealPurpose = {
    readonly kind: "release";
    readonly sandbox: string;
    readonly secret: string;
    readonly nonce: string;
} | {
    readonly kind: "type";
    readonly sandbox: string;
    readonly secret: string;
    readonly nonce: string;
} | {
    readonly kind: "inbox";
    readonly sandbox: string;
    readonly secret: string;
} | {
    readonly kind: "copy";
    readonly sandbox: string;
    readonly secret: string;
    readonly updatedAt: number;
} | {
    readonly kind: "sync";
    readonly account: string;
    readonly device: string;
    readonly revision: number;
} | {
    readonly kind: "capture";
    readonly via: string;
    readonly at: number;
} | {
    readonly kind: "phone";
    readonly device: string;
    readonly nonce: string;
};
export declare const sealAad: (purpose: SealPurpose) => Buffer;
export declare const sealWithEphemeral: (recipient: string, plaintext: string, purpose: SealPurpose, ephemeralPair: KeyringKeyPair, iv: Buffer) => SealedBox;
export declare const seal: (recipient: string, plaintext: string, purpose: SealPurpose) => SealedBox;
export declare const unseal: (pair: KeyringKeyPair, box: SealedBox, purpose: SealPurpose) => string;
export declare const grantNonce: () => string;
export declare const signGrant: (pair: KeyringKeyPair, grant: KeyringGrant) => SignedKeyringGrant;
export type GrantVerdict = {
    readonly ok: true;
    readonly grant: KeyringGrant;
} | {
    readonly ok: false;
    readonly code: "bad-grant" | "expired";
    readonly reason: string;
};
export declare const verifyGrant: (signKey: string, signed: SignedKeyringGrant, nowMs: number) => GrantVerdict;
export declare const keyFingerprint: (key: string) => string;
//# sourceMappingURL=keyring-seal.d.ts.map