import type { IKeyAgreementKey, IKeyResolver } from '@interop/data-integrity-core';
/**
 * The HKDF salt for the user key's client-side expansions; the one info label
 * under it lives with the signing half (`./userKeySigning.js`). Both
 * permanent: two wallet apps must expand the same user key to byte-identical
 * output, or a record one of them signs is a record the other refuses.
 */
export declare const USER_KEY_SALT = "freewallet/keys/user-key/v1";
/**
 * The user key material: the X25519 key-agreement half as minted by the epoch
 * construction (`id` is the key's own did:key; `secret` its raw 32-byte private
 * key). Random per account; held in memory for the life of a session and
 * persisted only inside a wrapped client-key record. The Ed25519 signing half
 * is not a member: it derives from `secret`, so a user key adopted from a
 * roster rotation is as complete an identity as a freshly minted one.
 */
export interface UserKey {
    id: string;
    secret: Uint8Array;
}
/**
 * Mints a fresh user key: the X25519 key-agreement pair via the was-client
 * epoch construction (its did:key is the key id, its raw secret is what wraps).
 * The signing half needs no minting -- it derives from the same secret.
 *
 * @returns {Promise<UserKey>}
 */
export declare function mintUserKey(): Promise<UserKey>;
/**
 * Reconstructs the user key's key-agreement key and its single-key resolver
 * from the stored material -- the vault-key pair a session supplies to the
 * storage layer, making the user key recipient zero of every encrypted
 * collection. The key id is the self-describing `<did:key>#<fingerprint>` form,
 * so grantee-side did:key recipient resolution routes it like any other roster
 * entry.
 *
 * @param options {object}
 * @param options.userKey {UserKey}
 * @returns {{ keyAgreementKey: IKeyAgreementKey, keyResolver: IKeyResolver }}
 */
export declare function userKeyVaultKeys({ userKey }: {
    userKey: UserKey;
}): {
    keyAgreementKey: IKeyAgreementKey;
    keyResolver: IKeyResolver;
};
//# sourceMappingURL=userKey.d.ts.map