import { type KeyPair } from './crypto.js';
import type { MsgFrame } from './conn.js';
export interface PayloadCryptoContext {
    keys: KeyPair;
    /** Own agentId — the DM AAD base on the receiving side. */
    selfAgentId: string;
    /** channel -> x25519 public key (b64) for encrypting outgoing channel sends. */
    channels: Record<string, string>;
    /** channel -> x25519 private key (b64) for decrypting; membership marker. */
    channelPrivs: Record<string, string>;
    /** whois lookup: agentId -> X25519 public key (b64, '' if absent). */
    peerXPub: (agentId: string) => Promise<string | undefined>;
}
export interface DecryptedPayload {
    channel?: string;
    dm: boolean;
    text: string;
}
/** Channel send: ECDH(sender x25519 priv, channel keypair pubkey). */
export declare function encryptForChannel(text: string, channel: string, frameId: string, ctx: PayloadCryptoContext): Promise<string>;
/** DM (DAP/1 addendum): whois the peer, then ECDH(sender x25519 priv,
 *  recipient x25519 pub from agent_info). */
export declare function encryptForDM(text: string, toAgentId: string, frameId: string, ctx: PayloadCryptoContext): Promise<string>;
/** Inbound msg frame -> plaintext. Channel frames use the channel private key
 *  (membership); DM frames use our own x25519 private key + the sender's
 *  x25519 public key from agent_info. */
export declare function decryptInbound(frame: MsgFrame, ctx: PayloadCryptoContext): Promise<DecryptedPayload>;