import { CipherSuite, type SenderContext, type Key } from 'hpke';
/**
 * Request context for response decryption.
 * Holds the HPKE sender context needed to derive response keys.
 */
export interface RequestContext {
    senderContext: SenderContext;
    requestEnc: Uint8Array;
}
/**
 * Serializable token containing the pre-computed bytes needed to decrypt a response.
 */
export interface SessionRecoveryToken {
    exportedSecret: Uint8Array;
    requestEnc: Uint8Array;
}
/**
 * Identity class for managing HPKE key pairs and encryption/decryption
 */
export declare class Identity {
    private suite;
    private publicKey;
    private privateKey;
    constructor(suite: CipherSuite, publicKey: Key, privateKey: Key);
    /**
     * Generate a new identity with X25519 key pair
     */
    static generate(): Promise<Identity>;
    /**
     * Create identity from JSON string
     */
    static fromJSON(json: string): Promise<Identity>;
    /**
     * Convert identity to JSON string
     */
    toJSON(): Promise<string>;
    /**
     * Get public key
     */
    getPublicKey(): Key;
    /**
     * Get public key as hex string
     */
    getPublicKeyHex(): Promise<string>;
    /**
     * Get private key
     */
    getPrivateKey(): Key;
    /**
     * Marshal public key configuration for server key distribution
     * Implements RFC 9458 format
     */
    marshalConfig(): Promise<Uint8Array>;
    /**
     * Unmarshal public configuration from server
     */
    static unmarshalPublicConfig(data: Uint8Array): Promise<Identity>;
    /**
     * Create an Identity from a raw public key hex string.
     * Uses the default cipher suite (X25519/HKDF-SHA256/AES-256-GCM).
     *
     * This is used by clients who already have the server's public key
     * and don't need to fetch it.
     */
    static fromPublicKeyHex(publicKeyHex: string): Promise<Identity>;
    /**
     * Create an Identity from raw public key bytes.
     * Uses the default cipher suite (X25519/HKDF-SHA256/AES-256-GCM).
     *
     * For public-key-only identities (client-side use), we create a placeholder
     * private key that won't be used. TODO: refactor Identity to not require
     * a private key for client-side use.
     */
    private static fromPublicKeyBytes;
    /**
     * Encrypt request body and return context for response decryption.
     *
     * This method is called on the SERVER's identity (public key only).
     * It:
     * 1. Creates an HPKE sender context to this identity's public key
     * 2. Encrypts the request body
     * 3. Returns a RequestContext that must be used to decrypt the response
     */
    encryptRequestWithContext(request: Request): Promise<{
        request: Request;
        context: RequestContext | null;
    }>;
    /**
     * Decrypt response using keys derived from request context.
     *
     * This method:
     * 1. Reads the response nonce from Ehbp-Response-Nonce header
     * 2. Exports a secret from the HPKE sender context
     * 3. Derives response keys using HKDF
     * 4. Decrypts the response body
     */
    decryptResponseWithContext(response: Response, context: RequestContext): Promise<Response>;
}
/**
 * Extract a serializable token from a RequestContext by exporting the HPKE secret.
 * The returned token contains only plain bytes and can be stored/serialized.
 */
export declare function extractSessionRecoveryToken(context: RequestContext): Promise<SessionRecoveryToken>;
/**
 * Serialize a SessionRecoveryToken to a JSON string with hex-encoded fields.
 * See SPEC.md Section 6.1.1.
 */
export declare function serializeSessionRecoveryToken(token: SessionRecoveryToken): string;
/**
 * Deserialize a SessionRecoveryToken from a JSON string with hex-encoded fields.
 * See SPEC.md Section 6.1.1.
 */
export declare function deserializeSessionRecoveryToken(json: string): SessionRecoveryToken;
/**
 * Decrypt a response using a SessionRecoveryToken.
 */
export declare function decryptResponseWithToken(response: Response, token: SessionRecoveryToken): Promise<Response>;
//# sourceMappingURL=identity.d.ts.map