/*!
 * Copyright (c) 2026 Interop Alliance.
 */
import type { ILDContext } from './LD.js';
export type IKeyPair = IVerificationKeyPair2018 | IVerificationKeyPair2020 | IMultikeyPair | IJSONWebKeyPair;
export type IPublicKey = IPublicKey2018 | IPublicKey2020 | IPublicMultikey | IJSONWebPublicKey;
export interface IKeyPairCore {
    '@context'?: ILDContext;
    id?: string;
    type?: string;
    controller?: string;
    revoked?: string;
}
export interface IPublicKey2018 extends IKeyPairCore {
    publicKeyBase58?: string;
}
export interface IVerificationKeyPair2018 extends IPublicKey2018 {
    privateKeyBase58?: string;
}
export interface IPublicKey2020 extends IKeyPairCore {
    publicKeyMultibase?: string;
}
export interface IKeyAgreementKeyPair2020 extends IPublicKey2020 {
    privateKeyMultibase?: string;
}
export interface IVerificationKeyPair2020 extends IPublicKey2020 {
    privateKeyMultibase?: string;
}
/**
 * @see https://www.w3.org/TR/cid-1.0/#Multikey
 */
export interface IPublicMultikey extends IKeyPairCore {
    publicKeyMultibase: string;
}
export interface IMultikeyPair extends IPublicMultikey {
    secretKeyMultibase: string;
}
/**
 * Multikey verification-method document -- either public-only
 * (`IPublicMultikey`) or with secret material (`IMultikeyPair`). The union is
 * the natural input type for importers: a `'secretKeyMultibase' in document`
 * check narrows it to `IMultikeyPair`. Both arms guarantee `publicKeyMultibase`
 * per the Multikey spec.
 * Used in various keys' from() factory methods.
 */
export type IMultikeyDocument = IPublicMultikey | IMultikeyPair;
/**
 * JWK key types, modeled as discriminated unions over `kty` (and `crv` where
 * applicable). Public variants forbid the private scalar `d` via `d?: never`,
 * so a secret JWK is not assignable to a public JWK at the type level.
 *
 * Add new key types (e.g. post-quantum ML-DSA `kty: 'AKP'`) by appending a
 * public/secret pair to the unions below.
 *
 * @see https://datatracker.ietf.org/doc/html/rfc7517
 * @see https://datatracker.ietf.org/doc/html/rfc7518
 */
/**
 * EC keys: P-256, P-384, P-521, secp256k1.
 */
export interface IECJWKCore {
    kty: 'EC';
    crv: 'P-256' | 'P-384' | 'P-521' | 'secp256k1';
    x: string;
    y: string;
    alg?: string;
    kid?: string;
    use?: 'sig' | 'enc';
}
export interface IECPublicJWK extends IECJWKCore {
    d?: never;
}
export interface IECSecretJWK extends IECJWKCore {
    d: string;
}
/**
 * OKP keys: Ed25519, Ed448 (signing); X25519, X448 (key agreement).
 */
export interface IOKPJWKCore {
    kty: 'OKP';
    crv: 'Ed25519' | 'Ed448' | 'X25519' | 'X448';
    x: string;
    alg?: string;
    kid?: string;
    use?: 'sig' | 'enc';
}
export interface IOKPPublicJWK extends IOKPJWKCore {
    d?: never;
}
export interface IOKPSecretJWK extends IOKPJWKCore {
    d: string;
}
/**
 * RSA keys. CRT parameters (p, q, dp, dq, qi) are RECOMMENDED but optional
 * per RFC 7518; only `d` is required for a private RSA JWK.
 */
export interface IRSAJWKCore {
    kty: 'RSA';
    n: string;
    e: string;
    alg?: string;
    kid?: string;
    use?: 'sig' | 'enc';
}
export interface IRSAPublicJWK extends IRSAJWKCore {
    d?: never;
    p?: never;
    q?: never;
    dp?: never;
    dq?: never;
    qi?: never;
}
export interface IRSASecretJWK extends IRSAJWKCore {
    d: string;
    p?: string;
    q?: string;
    dp?: string;
    dq?: string;
    qi?: string;
}
export type IPublicJWK = IECPublicJWK | IOKPPublicJWK | IRSAPublicJWK;
export type ISecretJWK = IECSecretJWK | IOKPSecretJWK | IRSASecretJWK;
/**
 * JWK-backed verification material -- contains public key material only.
 *
 * @see https://www.w3.org/TR/cid-1.0/#JsonWebKey
 */
export interface IJSONWebPublicKey extends IKeyPairCore {
    publicKeyJwk: IPublicJWK;
}
/**
 * JWK-backed key pair -- serialization form holding both halves. Project to
 * `IJSONWebPublicKey` before publishing in a DID or CID document.
 */
export interface IJSONWebKeyPair extends IJSONWebPublicKey {
    secretKeyJwk: ISecretJWK;
}
/**
 * JsonWebKey verification-method document -- either public-only
 * (`IJSONWebPublicKey`) or with secret material (`IJSONWebKeyPair`). The union
 * is the natural input type for importers: a `'secretKeyJwk' in document` check
 * narrows it to `IJSONWebKeyPair`. Both arms guarantee `publicKeyJwk`.
 * Used in various keys' from() factory methods.
 */
export type IJSONWebKeyDocument = IJSONWebPublicKey | IJSONWebKeyPair;
/**
 * @deprecated Renamed to IECJWKCore.
 */
export type IEcJwkCore = IECJWKCore;
/**
 * @deprecated Renamed to IECPublicJWK.
 */
export type IEcPublicJwk = IECPublicJWK;
/**
 * @deprecated Renamed to IECSecretJWK.
 */
export type IEcSecretJwk = IECSecretJWK;
/**
 * @deprecated Renamed to IOKPJWKCore.
 */
export type IOkpJwkCore = IOKPJWKCore;
/**
 * @deprecated Renamed to IOKPPublicJWK.
 */
export type IOkpPublicJwk = IOKPPublicJWK;
/**
 * @deprecated Renamed to IOKPSecretJWK.
 */
export type IOkpSecretJwk = IOKPSecretJWK;
/**
 * @deprecated Renamed to IRSAJWKCore.
 */
export type IRsaJwkCore = IRSAJWKCore;
/**
 * @deprecated Renamed to IRSAPublicJWK.
 */
export type IRsaPublicJwk = IRSAPublicJWK;
/**
 * @deprecated Renamed to IRSASecretJWK.
 */
export type IRsaSecretJwk = IRSASecretJWK;
/**
 * @deprecated Renamed to IPublicJWK.
 */
export type IPublicJwk = IPublicJWK;
/**
 * @deprecated Renamed to ISecretJWK.
 */
export type ISecretJwk = ISecretJWK;
/**
 * @deprecated Renamed to IJSONWebPublicKey.
 */
export type IJsonWebPublicKey = IJSONWebPublicKey;
/**
 * @deprecated Renamed to IJSONWebKeyPair.
 */
export type IJsonWebKeyPair = IJSONWebKeyPair;
/**
 * @deprecated Renamed to IJSONWebKeyDocument.
 */
export type IJsonWebKeyDocument = IJSONWebKeyDocument;
export interface ISignablePayload {
    data: Uint8Array;
}
export interface ISigner {
    id: string;
    algorithm?: string;
    sign: (signable: ISignablePayload) => Promise<Uint8Array>;
}
export interface IVerifiablePayload {
    data: Uint8Array;
    signature: Uint8Array;
}
export interface IVerifier {
    id?: string;
    algorithm?: string;
    verify: (data: IVerifiablePayload) => Promise<boolean>;
}
export interface IVerificationResult {
    verified: boolean;
    error?: Error;
}
export interface GenerateKeyPairOptions extends IKeyPairCore {
    seed?: Uint8Array;
}
/**
 * Abstract base class for "live" key pair instances -- the runtime half of the
 * IKeyPair contract defined above. Subclasses (e.g. Ed25519VerificationKey)
 * supply key material and the suite-specific signer()/verifier() methods.
 * Adapted from `@digitalcredentials/keypair`
 */
export declare abstract class AbstractKeyPair implements IKeyPairCore {
    id?: string;
    type?: string;
    controller?: string;
    revoked?: string;
    static SUITE_CONTEXT: string;
    /**
     * Creates a public/private key pair instance. This is an abstract base class,
     * actual key material and suite-specific methods are handled in the subclass.
     *
     * @param options {object} - The options to use.
     * @param options.id {string} - The key id, typically composed of controller
     *   URL and key fingerprint as hash fragment.
     * @param options.controller {string} - DID/URL of the person/entity
     *   controlling this key.
     * @param [options.revoked] {string} - Timestamp of when the key has been
     *   revoked, in RFC3339 format. If not present, the key itself is
     *   considered not revoked.
     */
    constructor({ id, controller, revoked }?: IKeyPairCore);
    /**
     * Generates a new public/private key pair instance.
     *
     * @param _options {GenerateKeyPairOptions} - Suite-specific options for the KeyPair --
     *   typically the IKeyPairCore metadata (id, controller, etc.) plus any
     *   subclass-specific generation inputs (e.g. a deterministic `seed`).
     *
     * @returns {Promise<AbstractKeyPair>} A KeyPair instance.
     */
    static generate(_options?: GenerateKeyPairOptions): Promise<AbstractKeyPair>;
    /**
     * Imports a key pair instance from a provided externally fetched key
     * document, optionally checking it for revocation and required context.
     *
     * @param options {object} - Options hashmap.
     * @param options.document {IKeyPairCore} - Externally fetched key document.
     * @param [options.checkContext] {boolean} - Whether to check that the
     *   fetched key document contains the context required by the key's crypto
     *   suite.
     * @param [options.checkRevoked] {boolean} - Whether to check the key
     *   object for the presence of the `revoked` timestamp.
     *
     * @returns {Promise<AbstractKeyPair>} Resolves with the resulting key pair instance.
     */
    static fromKeyDocument({ document, checkContext, checkRevoked }: {
        document: IKeyPairCore;
        checkContext?: boolean;
        checkRevoked?: boolean;
    }): Promise<AbstractKeyPair>;
    /**
     * Generates a KeyPair from some options.
     *
     * @param _options {IKeyPairCore} - Key pair description object.
     *
     * @returns {Promise<AbstractKeyPair>} A KeyPair.
     * @throws Unsupported Key Type.
     */
    static from(_options: IKeyPairCore): Promise<AbstractKeyPair>;
    /**
     * Exports the serialized representation of the KeyPair and other information
     * that json-ld Signatures can use to form a proof.
     *
     * NOTE: Subclasses MUST override this method (and add the exporting of
     * their public and private key material).
     *
     * Returns a `Promise` so that suites whose key material requires asynchronous
     * serialization (e.g. the WebCrypto-backed ECDSA suite, whose
     * `subtle.exportKey` is async) can override it. Suites with synchronous key
     * material may keep a synchronous method body (an `async export()` that does
     * no awaiting); the override's return type must still be `Promise<IKeyPair>`,
     * and callers `await` the result either way.
     *
     * @param [options] {object} - Options hashmap.
     * @param [options.publicKey] {boolean} - Export public key material?
     * @param [options.secretKey] {boolean} - Export secret key material?
     * @param [options.includeContext] {boolean} - Include the suite context?
     *
     * @returns {Promise<IKeyPair>} A public key object.
     */
    export({ publicKey, secretKey }?: {
        publicKey?: boolean;
        secretKey?: boolean;
        includeContext?: boolean;
    }): Promise<IKeyPair>;
    /**
     * Returns the public key fingerprint, multibase+multicodec encoded.
     *
     * @returns {string} The fingerprint.
     */
    abstract fingerprint(): string;
    /**
     * Verifies that a given key fingerprint matches the public key material
     * belonging to this key pair.
     *
     * @param options {object} - Options hashmap.
     * @param options.fingerprint {string} - Public key fingerprint.
     *
     * @returns {IVerificationResult} An object with verified flag.
     */
    abstract verifyFingerprint({ fingerprint }: {
        fingerprint: string;
    }): IVerificationResult;
    /**
     * Returns a signer object. NOTE: Applies only to verifier type keys.
     *
     * @returns {ISigner} A signer for json-ld usage.
     */
    abstract signer(): ISigner;
    /**
     * Returns a verifier object. NOTE: Applies only to verifier type keys.
     *
     * @returns {IVerifier} Used to verify jsonld-signatures.
     */
    abstract verifier(): IVerifier;
}
//# sourceMappingURL=KeyPair.d.ts.map