import type { IKeyAgreementKey } from '@interop/data-integrity-core';
import type { CollectionEncryptionRecipient } from '../types.js';
/**
 * The `did:key` method prefix. An epoch id IS a `did:key`, so this module owns
 * the grammar: it mints ids with the prefix, strips it back off to recover the
 * public key fingerprint, and `didKeyRecipient` reuses it to recognize the
 * controller DIDs it can derive a recipient key from.
 */
export declare const DID_KEY_PREFIX = "did:key:";
/**
 * A reader's public key-agreement key, as needed to wrap an epoch key to it:
 * the recipient `id` (`kid`, which the reader's own key-agreement key must also
 * report) and its `publicKeyMultibase`.
 */
export interface RecipientPublicKey {
    id: string;
    publicKeyMultibase: string;
    type?: string;
}
/**
 * Wraps a 32-byte epoch secret to one recipient's X25519 key-agreement key,
 * producing the JWE `recipients` entry stored on the descriptor. Generates a
 * fresh ephemeral key per call (ECDH-ES), so each wrap carries its own `epk`.
 *
 * @param options {object}
 * @param options.epochSecret {Uint8Array}       the 32-byte epoch key to wrap
 * @param options.recipient {RecipientPublicKey}   the reader's public KAK
 * @returns {Promise<CollectionEncryptionRecipient>}
 */
export declare function wrapEpochSecret({ epochSecret, recipient }: {
    epochSecret: Uint8Array;
    recipient: RecipientPublicKey;
}): Promise<CollectionEncryptionRecipient>;
/**
 * Unwraps an epoch secret from a descriptor `recipients` entry using the
 * reader's own key-agreement key. Returns `null` when this key does not match
 * the entry (the wrong recipient, or a corrupt entry) -- never treat `null` as
 * a key; try the next candidate entry or epoch, and fail with a typed error
 * when nothing unwraps.
 *
 * @param options {object}
 * @param options.entry {CollectionEncryptionRecipient}   the descriptor entry
 * @param options.keyAgreementKey {IKeyAgreementKey}      the reader's own KAK
 *   (its `id` must equal `entry.header.kid` for the derivation to match)
 * @returns {Promise<Uint8Array | null>}
 */
export declare function unwrapEpochSecret({ entry, keyAgreementKey }: {
    entry: CollectionEncryptionRecipient;
    keyAgreementKey: IKeyAgreementKey;
}): Promise<Uint8Array | null>;
/**
 * Mints a fresh key epoch: a new random X25519 key pair whose `did:key` is the
 * epoch id. Returns the id and the raw 32-byte secret (to wrap to recipients);
 * `resolveEpochKeys` reconstructs the epoch key pair from the id and secret when
 * a resource must be encrypted or decrypted under the epoch.
 *
 * @returns {Promise<{ epochId: string, secret: Uint8Array }>}
 */
export declare function mintEpoch(): Promise<{
    epochId: string;
    secret: Uint8Array;
}>;
/**
 * Reconstructs an epoch key pair from its id (a `did:key`, which carries the
 * public key) and the unwrapped 32-byte secret, ready to hand to the EDV
 * `documentCipher` as its `keyAgreementKey`.
 *
 * @param options {object}
 * @param options.epochId {string}      the epoch's `did:key`
 * @param options.secret {Uint8Array}   the unwrapped 32-byte epoch secret
 * @returns {X25519KeyAgreementKey2020}
 */
export declare function reconstructEpochKeyPair({ epochId, secret }: {
    epochId: string;
    secret: Uint8Array;
}): IKeyAgreementKey;
/**
 * The verification-method id of an epoch key: `<did:key>#<fingerprint>`. This is
 * the `kid` the EDV `documentCipher` stamps on a resource encrypted under the
 * epoch; a reader maps it back to the epoch by taking the `did:key` portion
 * before the `#` fragment.
 *
 * @param epochId {string}   the epoch's `did:key`
 * @returns {string}
 */
export declare function epochKeyIdFor(epochId: string): string;
/**
 * A `did:key` key resolver for X25519 key-agreement keys: resolves a
 * `did:key:z...#z...` id (an epoch key, or any self-describing X25519 key) to
 * its public verification method. The public key is the fragment, so no network
 * or registry lookup is needed. Memoized per id.
 *
 * @param options {object}
 * @param options.id {string}   the key id to resolve
 * @returns {Promise<{ id: string, type: string, publicKeyMultibase: string }>}
 */
export declare function didKeyResolver({ id }: {
    id?: string;
}): Promise<{
    id: string;
    type: string;
    publicKeyMultibase: string;
}>;
//# sourceMappingURL=epochCrypto.d.ts.map