/*!
 * Copyright (c) 2026 Interop Alliance. All rights reserved.
 */
/**
 * Resolves a reader's per-epoch keys from a Collection's `encryption`
 * descriptor. Given the descriptor (its `epochs` and `currentEpoch`) and the
 * reader's own key-agreement key, it reconstructs each epoch the reader is a
 * recipient of as an X25519 key pair the EDV `documentCipher` can use -- the
 * write epoch's key for writes, and one read key per epoch the reader holds (so
 * a resource written under an older epoch stays readable). The write epoch is
 * unwrapped eagerly; the other epochs' keys unwrap lazily on first decrypt
 * naming them, so a write-only handle does not pay to unwrap history it never
 * reads.
 *
 * This is the read axis: holding an epoch key lets a reader decrypt resources
 * written under it. A reader removed from a later epoch keeps the earlier epoch
 * keys and so keeps reading pre-rotation resources -- rotation is prospective,
 * never retroactive.
 */
import type { IKeyAgreementKey } from '@interop/data-integrity-core';
import type { CollectionEncryption } from '../types.js';
/**
 * The reader's resolved key-epoch material for a Collection.
 */
export interface ResolvedEpochKeys {
    /**
     * the epoch id writes encrypt under and stamp (the descriptor's
     * `currentEpoch`)
     */
    writeEpoch: string;
    /**
     * the key writes encrypt under
     */
    writeKey: IKeyAgreementKey;
    /**
     * every epoch key this reader can unwrap, for decrypting any epoch (the
     * `writeKey`, unwrapped eagerly, plus a lazily-unwrapped key per other epoch
     * this reader is a recipient of)
     */
    readKeys: IKeyAgreementKey[];
}
/**
 * Resolves the reader's epoch keys from a descriptor. Returns `null` when the
 * descriptor declares no epochs (the epoch codec refuses such a descriptor
 * fail-closed before calling this). Throws {@link KeyUnwrapError} when the
 * descriptor HAS epochs but this reader can unwrap none of them (it is not a
 * recipient), so an encrypted collection is never silently read/written with
 * the wrong key.
 *
 * @param options {object}
 * @param options.encryption {CollectionEncryption}   the Collection's descriptor
 * @param options.keyAgreementKey {IKeyAgreementKey}   the reader's own KAK; its
 *   `id` must match a recipient `kid` in an epoch for that epoch to unwrap
 * @returns {Promise<ResolvedEpochKeys | null>}
 */
export declare function resolveEpochKeys({ encryption, keyAgreementKey }: {
    encryption: CollectionEncryption;
    keyAgreementKey: IKeyAgreementKey;
}): Promise<ResolvedEpochKeys | null>;
//# sourceMappingURL=epochKeys.d.ts.map