import { CryptographyService } from 'gdc-common-utils-ts/CryptographyService';
import type { ICryptoHelper } from 'gdc-common-utils-ts/interfaces/ICryptoHelper';
import type { IWallet, WalletAlgorithm, WalletCompactJweRequest, WalletCompactJwsRequest, WalletDetachedJwsRequest, WalletExecutionContext, WalletKeyDescriptor, WalletKeyPurpose, WalletKeySelection, WalletPackOptions, WalletProvisionMode, WalletProvisionRequest, WalletUnpackOptions } from 'gdc-sdk-core-ts';
import type { JWK, JwkSet } from 'gdc-common-utils-ts/models/jwk';
export type NodeManagedWalletPolicy = {
    defaults: Partial<Record<WalletKeyPurpose, WalletAlgorithm>>;
};
export type NodeManagedWalletOptions = {
    cryptoHelper?: ICryptoHelper;
    cryptography?: CryptographyService;
    resolveRecipientJwk?: (recipientDid: string) => Promise<JWK>;
    policy?: Partial<NodeManagedWalletPolicy>;
};
export type NodeProfessionalIdentityVpInput = Readonly<{
    clientId: string;
    actorDid: string;
    profileDid?: string;
    role: string;
    email?: string;
    sameAs?: string | readonly string[];
    telephone?: string;
    credentialMaterial?: string;
    /** Server-authorized credentials appended after the professional identity VC. */
    additionalCredentials?: ReadonlyArray<object>;
}>;
export type NodeCommunicationWalletInitialization = {
    /**
     * Stable secret used to reconstruct the same communication keys after a
     * process restart. Persist it only through the portal's protected wallet
     * store; never send it to ICA or GW.
     */
    seedMaterial?: string | Uint8Array;
    /**
     * Defaults to deterministic when seedMaterial is present, otherwise random.
     * Random keys are suitable only when the wallet implementation itself is
     * durably persisted.
     */
    mode?: WalletProvisionMode;
};
/**
 * Node-focused managed wallet implementation for BFF, portal, and backend flows.
 *
 * This adapter keeps actor/profile keys separate from runtime/channel keys and
 * exposes one shared `IWallet` contract suitable for:
 * - user/domain signing
 * - OpenID/JWT signing
 * - DIDComm-style transport wrapping
 * - confidential document protection
 *
 * OpenID boundary: managing an `openid-id-token-signing` key and producing a
 * compact JWT does not turn this wallet into an OpenID Provider. The hosting
 * portal/BFF must authenticate the account, verify any asserted email, publish
 * provider metadata and JWKS, and be explicitly trusted by the receiving GW.
 */
export declare class NodeManagedWallet implements IWallet {
    private readonly cryptoHelper;
    private readonly cryptography;
    private readonly resolveRecipientJwk?;
    private readonly policy;
    private readonly owners;
    /**
     * Creates one managed wallet backed by `CryptographyService` and Node crypto.
     */
    constructor(options?: NodeManagedWalletOptions);
    /**
     * Legacy provisioning shape kept for app compatibility.
     *
     * It provisions one profile-owned signing key, one runtime communication
     * signing key, and one runtime communication encryption key while returning
     * the signing/encryption public keys expected by older app-facing flows.
     */
    provisionKeys(entityId: string): Promise<JwkSet>;
    /**
     * Rich provisioning shape for actor/profile keys and runtime/channel keys.
     */
    provisionManagedKeys(context: WalletExecutionContext, request: WalletProvisionRequest): Promise<JwkSet>;
    /**
     * Returns the currently available public JWKs for the selected context and filter.
     */
    getPublicJwks(context?: WalletExecutionContext, filter?: WalletKeySelection): Promise<WalletKeyDescriptor[]>;
    /**
     * Initializes one user/profile device communication wallet and returns only
     * its public signing/encryption JWKS. The wallet is actor-role neutral: the
     * same custody contract can back a controller, employee/professional or
     * individual-controller profile.
     *
     * These communication keys do not replace the actor's person/professional-
     * role signing key. In the historical legal-representative flow, for example,
     * this returned set is accepted as `controller.publicKeys`, while the
     * independent role key is supplied as `controller.publicSignKey`.
     *
     * The caller owns durable wallet custody. When deterministic provisioning is
     * used, protect `seedMaterial` in the portal wallet store (for example with
     * its KMS/KEK and optionally a user PIN) and persist the same non-secret
     * `context.runtime.runtimeId`. A fresh `NodeManagedWallet` reconstructs the
     * same private keys from that seed and context after restart, so private JWKs
     * do not need separate persistence. Only the returned public JWKS may be
     * submitted when the selected high-level onboarding flow requires it.
     */
    initializeCommunicationJsonWebKeySet(context: WalletExecutionContext, options?: NodeCommunicationWalletInitialization): Promise<JwkSet>;
    /**
     * Returns only the public DIDComm signing/encryption keys for a previously
     * initialized user/profile device runtime wallet. Private material never
     * leaves the wallet, and the returned keys do not convey an actor role.
     */
    getCommunicationJsonWebKeySet(context: WalletExecutionContext): Promise<JwkSet>;
    /**
     * Computes a digest of a string using the configured runtime helper.
     */
    digest(data: string, algorithm: string): Promise<string>;
    /** Protects one document with a random AES-256-GCM CEK wrapped to the owner's storage ML-KEM key. */
    protectConfidentialData(doc: any, entityId: string): Promise<any>;
    /**
     * Protects one confidential document using the richer execution-context model.
     */
    protectManagedConfidentialData(doc: any, context: WalletExecutionContext, _options?: {
        key?: WalletKeySelection;
    }): Promise<any>;
    /**
     * Decrypts one confidential document using the legacy entity id shape.
     */
    unprotectConfidentialData(doc: any, entityId: string): Promise<any>;
    /**
     * Decrypts one confidential document using the richer execution-context model.
     */
    unprotectManagedConfidentialData(doc: any, context: WalletExecutionContext, _options?: {
        key?: WalletKeySelection;
    }): Promise<any>;
    /**
     * Signs arbitrary bytes or one UTF-8 string using the selected managed key.
     */
    sign(payload: Uint8Array | string, context: WalletExecutionContext, options: WalletKeySelection): Promise<string>;
    /**
     * Verifies one signature against the provided public JWK.
     */
    verify(payload: Uint8Array | string, signature: string, jwk: JWK, options?: {
        alg?: WalletAlgorithm;
    }): Promise<boolean>;
    /**
     * Encrypts one payload for the provided recipient public JWK.
     */
    encrypt(plaintext: Uint8Array | string, recipientJwk: JWK, options?: {
        context?: WalletExecutionContext;
        key?: WalletKeySelection;
        contentType?: string;
    }): Promise<string>;
    /**
     * Decrypts one ciphertext using one selected local encryption key.
     */
    decrypt(ciphertext: string, context: WalletExecutionContext, options?: {
        key?: WalletKeySelection;
    }): Promise<Uint8Array>;
    /**
     * Builds one compact JWS using one managed signing key.
     */
    signCompactJws(context: WalletExecutionContext, request: WalletCompactJwsRequest): Promise<string>;
    /**
     * Builds and signs the canonical employee/professional VP with the managed
     * `vp-token-signing` key. Callers provide identity facts only; they do not
     * assemble JOSE headers, choose a JWK or handle private key material.
     */
    signProfessionalIdentityVp(context: WalletExecutionContext, input: NodeProfessionalIdentityVpInput): Promise<string>;
    /**
     * Builds one detached compact JWS using one managed signing key.
     */
    signDetachedJws(context: WalletExecutionContext, request: WalletDetachedJwsRequest): Promise<string>;
    /**
     * Builds one compact JWE using one selected local ML-KEM key and one recipient public JWK.
     */
    buildCompactJwe(context: WalletExecutionContext, request: WalletCompactJweRequest): Promise<string>;
    /**
     * Decrypts one compact JWE using one selected local ML-KEM key.
     */
    decryptCompactJwe(jwe: string, context: WalletExecutionContext, options: {
        key: WalletKeySelection;
    }): Promise<Uint8Array>;
    /**
     * Legacy pack shape retained for app compatibility.
     */
    packForRecipient(content: any, recipientDid: string): Promise<string>;
    /**
     * Packs one payload into a transport envelope signed and encrypted by the runtime.
     */
    packForRecipientWithContext(content: any, recipientDidOrJwk: string | JWK, options: WalletPackOptions): Promise<string>;
    /**
     * Packs the first activation/DCR requests before GW can resolve this
     * installation's communication keys from a registered DID document.
     *
     * The embedded public keys are bootstrap response and signature material;
     * callers must still authenticate the HTTP request with the trusted OIDC
     * token and one server-authorized activation code. Post-DCR operations must
     * use `packForRecipientWithContext` so registered key custody is resolved.
     */
    packProfileBootstrapForRecipientWithContext(content: any, recipientDidOrJwk: string | JWK, options: WalletPackOptions): Promise<string>;
    /**
     * Legacy unpack shape retained for app compatibility.
     */
    unpack(packedMessage: string): Promise<{
        content: any;
        meta: any;
    }>;
    /**
     * Unpacks one transport envelope and returns the decoded business payload plus JOSE metadata.
     */
    unpackWithContext(packedMessage: string, options: WalletUnpackOptions): Promise<{
        content: any;
        meta: any;
    }>;
    private getOrCreateOwnerState;
    private tryGetOwnerState;
    private resolveOwnerId;
    private resolveStorageOwnerId;
    private createManagedKey;
    private requireManagedKey;
    private inferRelevantScopes;
    private matchesSelection;
    private resolveAlgorithmForPurpose;
    private deriveSignerSeed;
    private deriveSeedBytes;
    private deriveDeterministicBlock;
    private resolveNodeDigestForAlgorithm;
    private resolveRecipientPublicJwk;
}