@icure/api 6.4.0 → 7.0.0-beta.1

package/icc-x-api/icc-crypto-x-api.d.ts

@@ -1,323 +1,272 @@
-import { IccDeviceApi, IccHcpartyApi, IccPatientApi } from '../icc-api';
 import { AESUtils } from './crypto/AES';
-import { RSAUtils } from './crypto/RSA';
+import { KeyPair, RSAUtils } from './crypto/RSA';
 import { ShamirClass } from './crypto/shamir';
 import { Delegation, Device, Document, EncryptedEntity, EncryptedParentEntity, HealthcareParty, Patient, User } from '../icc-api/model/models';
-import { IccMaintenanceTaskXApi } from './icc-maintenance-task-x-api';
 import { StorageFacade } from './storage/StorageFacade';
 import { KeyStorageFacade } from './storage/KeyStorageFacade';
+import { ExchangeKeysManager } from './crypto/ExchangeKeysManager';
+import { CryptoPrimitives } from './crypto/CryptoPrimitives';
+import { KeyManager } from './crypto/KeyManager';
+import { DataOwner, DataOwnerWithType, IccDataOwnerXApi } from './icc-data-owner-x-api';
+import { EntitiesEncryption } from './crypto/EntitiesEncryption';
+import { IcureStorageFacade } from './storage/IcureStorageFacade';
+import { ShamirKeysManager } from './crypto/ShamirKeysManager';
+import { IccHcpartyApi } from '../icc-api';
+import { ConfidentialEntities } from './crypto/ConfidentialEntities';
 interface DelegatorAndKeys {
     delegatorId: string;
     key: CryptoKey;
     rawKey: string;
 }
-type CachedDataOwner = {
-    type: 'patient';
-    dataOwner: Patient;
-} | {
-    type: 'device';
-    dataOwner: Device;
-} | {
-    type: 'hcp';
-    dataOwner: HealthcareParty;
-};
 export declare class IccCryptoXApi {
+    keychainLocalStoreIdPrefix: string;
+    keychainValidityDateLocalStoreIdPrefix: string;
+    hcpPreferenceKeyEhealthCert: string;
+    hcpPreferenceKeyEhealthCertDate: string;
+    rsaLocalStoreIdPrefix: string;
+    private readonly exchangeKeysManager;
+    private readonly cryptoPrimitives;
+    private readonly keyManager;
+    private readonly dataOwnerApi;
+    private readonly entitiesEncrypiton;
+    private readonly confidentialEntities;
+    private readonly icureStorage;
+    private readonly shamirManager;
+    private readonly _storage;
+    private readonly _keyStorage;
+    private readonly hcpartyBaseApi;
+    get primitives(): CryptoPrimitives;
+    /**
+     * @internal this method is for internal use only and may be changed without notice.
+     */
+    get exchangeKeys(): ExchangeKeysManager;
+    /**
+     * @deprecated replace with {@link CryptoPrimitives.crypto} at {@link primitives}.
+     */
     get crypto(): Crypto;
+    /**
+     * @deprecated replace with {@link CryptoPrimitives.shamir} at {@link primitives}.
+     */
     get shamir(): ShamirClass;
+    /**
+     * @deprecated replace with {@link CryptoPrimitives.RSA} at {@link primitives}.
+     */
     get RSA(): RSAUtils;
+    /**
+     * @deprecated replace with {@link CryptoPrimitives.AES} at {@link primitives}.
+     */
     get AES(): AESUtils;
+    /**
+     * @internal this is for internal use only and may be changed without notice.
+     */
     get keyStorage(): KeyStorageFacade;
+    /**
+     * @internal this is for internal use only and may be changed without notice.
+     */
     get storage(): StorageFacade<string>;
-    hcPartyKeysCache: {
-        [key: string]: DelegatorAndKeys;
-    };
-    hcPartyKeysRequestsCache: {
-        [delegateId: string]: Promise<{
-            [key: string]: {
-                [key: string]: {
-                    [key: string]: string;
-                };
-            };
-        }>;
-    };
-    cacheLastDeletionTimestamp: number | undefined;
-    dataOwnerCache: {
-        [key: string]: Promise<CachedDataOwner>;
-    };
+    /**
+     * @internal this is for internal use only and may be changed without notice.
+     */
+    get entities(): EntitiesEncryption;
+    /**
+     * @internal this is for internal use only and may be changed without notice.
+     */
+    get confidential(): ConfidentialEntities;
+    /**
+     * @internal this is for internal use only and may be changed without notice.
+     */
+    get userKeysManager(): KeyManager;
+    /**
+     * @internal this is for internal use only and may be changed without notice.
+     */
+    get shamirKeysManager(): ShamirKeysManager;
+    /**
+     * @internal
+     */
+    constructor(exchangeKeysManager: ExchangeKeysManager, cryptoPrimitives: CryptoPrimitives, keyManager: KeyManager, dataOwnerApi: IccDataOwnerXApi, entitiesEncrypiton: EntitiesEncryption, shamirManager: ShamirKeysManager, storage: StorageFacade<string>, keyStorage: KeyStorageFacade, icureStorageFacade: IcureStorageFacade, hcPartyBaseApi: IccHcpartyApi, confidentialEntities: ConfidentialEntities);
+    /**
+     * Deletes values cached by the crypto api, to allow to detect changes in stored key pairs, exchange keys and/or current data owner details.
+     * This method may be useful in cases where a user is logged in from multiple devices or in cases where other users have just shared some data with
+     * the current user for the first time.
+     */
+    forceReload(): Promise<void>;
+    /**
+     * Get a key pair with the provided fingerprint if present.
+     * @param fingerprint a key-pair/public-key fingerprint
+     * @return the pair associated to the fingerprint and a boolean indicating if the pair is verified, if present, else undefined
+     */
+    getKeyPairForFingerprint(fingerprint: string): {
+        pair: KeyPair<CryptoKey>;
+        verified: boolean;
+    } | undefined;
+    /**
+     * Get the public keys of available key pairs for the current user and his parents in hex-encoded spki representation (uses cached keys: no request
+     * is done to the server).
+     * Note that this will also include unverified keys.
+     * @return the spki representation of public keys of available keypairs for the current user.
+     */
+    getCurrentUserHierarchyAvailablePublicKeysHex(): Promise<string[]>;
+    /**
+     * Get the public keys of available key pairs for the current user in hex-encoded spki representation (uses cached keys: no request is done to the
+     * server).
+     * By setting {@link verifiedOnly} to true only the public keys for verified key pairs will be returned: these will include only key pairs created
+     * on this device or which have been verified using {@link CryptoStrategies} on this device.
+     * @param verifiedOnly if true only the verified public keys will be returned.
+     * @return the spki representation of public keys of available keypairs for the current user.
+     */
+    getCurrentUserAvailablePublicKeysHex(verifiedOnly: boolean): Promise<string[]>;
+    /**
+     * @deprecated depending on your use case you should delete the calls to this method or call {@link forceReload}:
+     * - Replace with `forceReload()` if one of the following parts of the current data owner may have been modified from a different api instance:
+     *   - Hcp hierarchy
+     *   - Key recovery data (transfer keys or shamir)
+     *   - Exchange keys (formerly hcp keys)
+     * - Remove the call if the main goal was to force reload the data owner: data owner are not cached anymore.
+     */
     emptyHcpCache(hcpartyId: string): void;
     /**
-     * Gets all delegate encrypted HcParty keys of the delegate with the given `delegateHcPartyId`, and for each key the delegator id
-     * If the keys are not cached, they are retrieved from the backend.
-     *
-     * @param delegateHcPartyId The Health Care Party id
-     * @returns  \{delegatorId: delegateEncryptedHcPartyKey\}
+     * @deprecated you should not need this method anymore to deal with the encryption of iCure entities because everything related to entities
+     * encryption should be done either through the entity-specific extended api or through the extended apis.
+     * Note that keys returned by the current implementation of this method may not be safe for encryption/sharing.
+     * If instead you are using this method to retrieve key pairs for other purposes, for example because you want to reuse the user keys in iCure for
+     * other services consider the following alternatives:
+     * - If you want to use all iCure facilities including key recovery and key verification you can use {@link getKeyPairForFingerprint}.
+     *   Note that this solution can only give access to keys for the data owner of the instantiated api and his parents.
+     * - Alternatively you can use directly your choice of {@link KeyStorageFacade} and {@link StorageEntryKeysFactory}: if these are the same you use
+     *   for the iCure API client the keys will be shared with it. Note however that the iCure api client uses
+     *   {@link StorageEntryKeysFactory.cachedRecoveredKeypairOfDataOwner} to cache recovered keys of a data owner which may not have originated from
+     *   this device, so you should only use {@link StorageEntryKeysFactory.deviceKeypairOfDataOwner} if you want to make sure the keys you use are safe
+     *   for encryption.
      */
-    private getEncryptedAesExchangeKeysForDelegate;
-    private forceGetEncryptedAesExchangeKeysForDelegate;
-    keychainLocalStoreIdPrefix: string;
-    keychainValidityDateLocalStoreIdPrefix: string;
-    hcpPreferenceKeyEhealthCert: string;
-    hcpPreferenceKeyEhealthCertDate: string;
-    rsaLocalStoreIdPrefix: string;
-    private hcpartyBaseApi;
-    private patientBaseApi;
-    private deviceBaseApi;
-    private readonly _crypto;
-    private generateKeyConcurrencyMap;
-    private rsaKeyPairs;
-    private readonly _AES;
-    private readonly _RSA;
-    private readonly _shamir;
-    private readonly _storage;
-    private readonly _keyStorage;
-    constructor(host: string, headers: {
-        [key: string]: string;
-    }, hcpartyBaseApi: IccHcpartyApi, //Init with a hcparty x api for better performances
-    patientBaseApi: IccPatientApi, deviceBaseApi: IccDeviceApi, crypto: Crypto | undefined, storage: StorageFacade<string>, keyStorage: KeyStorageFacade);
-    loadAllKeysFromLocalStorage(dataOwnerId: string): Promise<void>;
     getCachedRsaKeyPairForFingerprint(dataOwnerId: string, pubKeyOrFingerprint: string): Promise<{
         publicKey: CryptoKey;
         privateKey: CryptoKey;
     }>;
+    /**
+     * @deprecated You do not need this method to encrypt/decrypt data of iCure, but if you want to reuse the iCure keys for the user for other purposes
+     * you have different options to replace this method, depending on what you actually need. All options return the hex-encoded spki representation of
+     * the public keys.
+     * - If you want only the public keys for which we have a private key available
+     *   - you can replicate the current behaviour using {@link getCurrentUserHierarchyAvailablePublicKeysHex}. This includes keys for the current user
+     *   and his parents.
+     *   - use {@link getCurrentUserAvailablePublicKeysHex} to get public keys only for the current data owner, ignoring any keys of the
+     *     parent hierarchy. In this case you can also apply a filter to only get verified keys (safe for encryption).
+     * - If you need all public keys for the data owner, including those for which there is no corresponding private key available on the device use
+     *   {@link IccDataOwnerXApi.getHexPublicKeysOf} with the current data owner. If you don't have it available you may get it from
+     *   {@link IccDataOwnerXApi.getCurrentDataOwner}, but this will require to do a request to the iCure server (other options use only cached data).
+     */
     getPublicKeys(): Promise<string[]>;
-    getPublicKeysAsSpki(): Promise<string[]>;
+    /**
+     * @deprecated replace with {@link CryptoPrimitives.randomUuid} at {@link primitives}.
+     */
     randomUuid(): string;
+    /**
+     * @deprecated replace with {@link CryptoPrimitives.sha256} at {@link primitives}.
+     */
     sha256(data: ArrayBuffer | Uint8Array): Promise<ArrayBuffer>;
+    /**
+     * @deprecated Use {@link ShamirKeysManager.updateSelfSplits} from {@link shamirKeysManager} instead. Note that the new method completely replaces
+     * all current values if a split for the provided key already exists.
+     */
     encryptShamirRSAKey(hcp: HealthcareParty, notaries: Array<HealthcareParty>, threshold?: number): Promise<HealthcareParty>;
+    /**
+     * @deprecated You should not need this method anymore because the api will automatically try to recover the available shamir keys on startup.
+     */
     decryptShamirRSAKey(hcp: HealthcareParty, notaries: Array<HealthcareParty>): Promise<void>;
     /**
-     * Gets the decryptedHcPartyKey for the given `encryptedHcPartyKey`
-     *
-     * If the decrypted key exists in the cache, retrieves it from there.
-     * Otherwise, decrypts it using the RSA key of the delegator or delegate (depending on the value of `encryptedForDelegator`)
-     *
-     * @param loggedHcPartyId The logged DataOwner id or the id of his parent
-     * @param delegatorId The id of Delegator eg, the DataOwner where this AES exchange key is stored
-     * @param delegateHcPartyId The id of the delegate : the data owner for whom this aes exchange key has been created
-     * @param publicKey The public key of the delegator : A unique aes exchange key is created for each public key of the delegator. This is the public key corresponding to the encryptedHcPartyKeys
-     * @param encryptedHcPartyKeys The encryptedHcPartyKeys to be decrypted
-     * @param publicKeys The public keys for which we might have a private key
-     *
-     * @returns - **delegatorId** the input param  `delegatorId`
-     * - **key** the decrypted `encryptedHcPartyKey`
+     * @deprecated you should not need this method anymore because everything related to entities encryption should be done either through the
+     * entity-specific extended api.
+     * Note that currently this method does not cache results anymore (but the updated methods do).
      */
     decryptHcPartyKey(loggedHcPartyId: string, delegatorId: string, delegateHcPartyId: string, publicKey: string, encryptedHcPartyKeys: {
         [key: string]: string;
     }, publicKeys: string[]): Promise<DelegatorAndKeys>;
     /**
-     * Cache the RSA private/public key pair for the HcP with the given id `hcPartyKeyOwner`
+     * @deprecated you should not need this method anymore. The new API will automatically load on startup all keys available through the key storage
+     * facade and/or recoverable through transfer keys or shamir split. If no verified key (safe for encryption) can be found during the instantiation
+     * of the API, depending on the parameters passed to the factory one of two scenarios will happen:
+     * - A new key will be automatically created on the device and stored using the key storage facade.
+     * - The api instantiation fails with an exception. This is ideal if you want to try to recover an existing key pair before creating a new one.
+     *
+     * If you were using this method to allow the user to recover an existing key that is not available in the storage facade nor recoverable through
+     * transfer keys or shamir split (for example by scanning a qr code, or by loading a file from the computer to the web browser's local storage)
+     * you will have to move that logic in your implementation of CryptoStrategies.
+     * It is currently not allowed to create new key pairs if a verified key pair is already available on the device, as this would be wasteful.
+     * If you want to convert a `JsonWebKey` pair to a `CryptoKey` pair you should use directly the method in `primitives.RSA`.
      */
-    cacheKeyPair(keyPairInJwk: {
-        publicKey: JsonWebKey;
-        privateKey: JsonWebKey;
-    }): Promise<{
-        publicKey: CryptoKey;
-        privateKey: CryptoKey;
-    }>;
+    cacheKeyPair(keyPairInJwk: KeyPair<JsonWebKey>): Promise<KeyPair<CryptoKey>>;
     /**
-     * Gets the secret ID (SFKs) that should be used in the prescribed context (confidential or not) from decrypted SPKs of the given `parent`, decrypted by the HcP with the given `hcpartyId` AND by its HcP parents
-     * @param parent :the object of which delegations (SPKs) to decrypt
-     * @param hcpartyId :the id of the delegate HcP
-     * @param confidential :weather the key is going to be used for a confidential piece or data or not
-     * @returns - **extractedKeys** array containing secret IDs (SFKs) from decrypted SPKs, from both given HcP and its parents ; can contain duplicates
-     * - **hcpartyId** the given `hcpartyId` OR, if a parent exist, the HcP id of the top parent in the hierarchy  (even if that parent has no delegations)
+     * @deprecated Usually you should not need this method, since the preferred sfk is automatically chosen by the extended entity apis when creating a
+     * new instance of the entity.
      */
     extractPreferredSfk(parent: EncryptedParentEntity, hcpartyId: string, confidential: boolean): Promise<string | undefined>;
     /**
-     * Gets an array of decrypted HcPartyKeys, shared between the delegate with ID `delegateHcPartyId` and the delegators in `delegatorsHcPartyIdsSet`
-     *
-     * 1. Get the keys for the delegateHealthCareParty (cache/backend).
-     * 2. For each key in the delegators, decrypt it with the delegate's private key
-     * 3. Filter out undefined keys and return them
-     *
-     * @param delegatorsHcPartyIdsSet array of delegator HcP IDs that could have delegated something to the HcP with ID `delegateHcPartyId`
-     * @param delegateHcPartyId the HcP for which the HcPs with IDs in `delegatorsHcPartyIdsSet` could have delegated something
-     * @param minCacheDurationInSeconds The minimum cache duration
-     * @returns - **delegatorId** : the id of the delegator HcP that shares the **key** with the `delegateHcPartyId`
-     *  - **key** the decrypted HcPartyKey, shared between **delegatorId** and `delegateHcPartyId`
+     * @deprecated you should not need this method anymore because everything related to entities encryption should be done either through the
+     * entity-specific extended api.
      */
     decryptAndImportAesHcPartyKeysForDelegators(delegatorsHcPartyIdsSet: Array<string>, delegateHcPartyId: string, minCacheDurationInSeconds?: number): Promise<Array<DelegatorAndKeys>>;
     /**
-     * Gets an array of decrypted HcPartyKeys from the given `delegations`, that are shared with / can be decrypted by the HcP with the given `healthcarePartyId` (or by its parents when `fallbackOnParent` is true)
-     *
-     * 1. Checks whether the delegations' object has a delegation for the
-     * given healthCarePartyId.
-     * 2. Enumerates all the delegators (delegation.owner) present in
-     * the delegations.
-     * 3. Decrypt's delegators' keys and returns them.
-     *
-     * @param dataOwnerId : the id of the delegate HCP
-     * @param delegations : delegations (can be SPKs, CFKs, EKs) for all delegates
-     * @param fallbackOnParent  default true; use parent's healthCarePartyId in case there's no delegation for the `healthcarePartyId`
-     * @returns  - **delegatorId** : the id of the delegator HcP that shares the **key** with the `healthcarePartyId`
-     *  - **key** the decrypted HcPartyKey, shared between **delegatorId** and `healthcarePartyId`
-     */
-    getDecryptedAesExchangeKeysOfDelegateAndParentsFromGenericDelegations(dataOwnerId: string, delegations: {
-        [key: string]: Array<Delegation>;
-    }, fallbackOnParent?: boolean): Promise<Array<DelegatorAndKeys>>;
-    /**
-     * Retrieve the owner HealthCareParty key and use it to encrypt
-     * both the delegations (createdObject.id) and the cryptedForeignKeys
-     * (parentObject.id), and returns them in an object.
+     * @deprecated you should not need this method anymore because everything related to entities encryption should be done either through the
+     * entity-specific extended api.
+     * Note that currently this method does not cache results anymore (but the updated methods do).
      */
-    initObjectDelegations(createdObject: any, parentObject: any, ownerId: string, secretForeignKeyOfParent: string | null): Promise<{
-        owner: HealthcareParty | Device | Patient;
-        delegations: any;
-        cryptedForeignKeys: any;
-        secretForeignKeys: any[];
-        secretId: string;
-    }>;
-    private decryptAnyAesExchangeKeyForOwner;
-    /**
-     * Gets updated instances of SPKs and CKFs for the child object `modifiedObject`.
-     * These updated SPKs and CKFs contain new SPKs/CFKs to provide delegation from delegator HcP with id `ownerId` to delegate HcP with id `delegateId`
-     *
-     * 1. if `secretIdOfModifiedObject` is not provided, the method will throw an exception; this `secretIdOfModifiedObject` is used to generate a new delegation (SPK) in step 3;
-     *  the `secretIdOfModifiedObject` is returned, unmodified, as `secretId`
-     * 2. if the owner (delegator) did not perform a delegation to the delegate, then this HcP delegation (creation of a new HcPKey) is performed now
-     * 3. creates a new delegation (Secret Primary Keys) on the `modifiedObject` encrypted with the HcPKey from owner to the delegate;
-     * 4. if `parentObject` != null, creates a new CFK on the `modifiedObject` encrypted with the HcPKey from owner to the delegate;
-     * 5. this new delegation (from step 3) is added to the list of existing delegations (Secret Primary Keys) on the `modifiedObject` for the delegate given by `delegateId`
-     * 6. if the CFK (from step 4) can be created, this new CFK is added to the list of existing CFKs on the `modifiedObject` for the delegate given by `delegateId`
-     * 7. then some duplicates delegations (SPKs) and CKFs are removed
-     *
-     * @param modifiedObject : the object of which SPKs and CFKs will be cloned, the clones will be modified and then used as returned values ; it's a 'child' of `parentObject`; will NOT be mutated
-     * @param parentObject : will NOT be mutated
-     * @param ownerId : the HcP id of the delegator
-     * @param delegateId : the HcP id of the delegate
-     * @param secretIdOfModifiedObject : the secret id used in the child object to generate its SPK
-     * @returns - **delegations**  existing delegations (SPKs) of the `modifiedObject`, appended with results from step 5
-     * - **cryptedForeignKeys** existing CFKs of the `modifiedObject`, appended with results from steps 6
-     * - **secretId** which is the given input parameter `secretIdOfModifiedObject`
-     */
-    extendedDelegationsAndCryptedForeignKeys<T extends EncryptedEntity, P extends EncryptedParentEntity>(modifiedObject: T, parentObject: P | null, ownerId: string, delegateId: string, secretIdOfModifiedObject: string | null): Promise<{
-        modifiedObject: T;
-        delegations: {
-            [key: string]: Array<Delegation>;
-        };
-        cryptedForeignKeys: {
-            [key: string]: Array<Delegation>;
-        };
-        secretId: string | null;
-    }>;
-    private _getDelegateIdsOf;
     getEncryptedAesExchangeKeys(owner: HealthcareParty | Patient | Device, delegateId: string): Promise<{
         [pubKeyIdentifier: string]: {
             [pubKeyFingerprint: string]: string;
         };
     }>;
-    getOrCreateHcPartyKeys(owner: HealthcareParty | Patient | Device, delegateId: string): Promise<{
-        owner: HealthcareParty | Patient | Device;
-        aesExchangeKeys: {
-            [pubKeyIdentifier: string]: {
-                [pubKeyFingerprint: string]: string;
-            };
-        };
-    }>;
     /**
-     * Retrieve the owners HealthCareParty key, decrypt it, and
-     * use it to encrypt & initialize the "encryptionKeys" object
-     * and return it.
-     * @param createdObject
-     * @param ownerId
+     * @deprecated you should not use this method because initialisation of encrypted entities keys is done automatically by the entity-specific
+     * extended api. Also note that it is now forbidden to initialise an entity as a data owner which is not the current data owner: you should instead
+     * create the entity as the current data owner then create a delegation to the other data owner.
      */
     initEncryptionKeys(createdObject: any, ownerId: string): Promise<{
         encryptionKeys: any;
         secretId: string;
-        modifiedOwner: Patient | Device | HealthcareParty;
     }>;
     /**
-     * Gets an updated instance of the EKs of `modifiedObject`.
-     * The updated EKs contain a new EK to provide delegation from delegator HcP with id `ownerId` to delegate HcP with id `delegateId`.
-     * @param modifiedObject : the object of which EKs will be cloned, the clone will be used to append the new EK, and then used as return value; will NOT be mutated
-     * @param ownerId : delegator HcP id
-     * @param delegateId : delegate HcP id
-     * @param secretEncryptionKeyOfObject : secret Id for the EK (Content Encryption Key)
-     * @returns
-     *   - **encryptionKeys** existing EKs of the `modifiedObject`, appended with a new EK item (owner: `ownerId`, delegatedTo: `delegateId`, encrypted key with secretId:
-     *     `secretEncryptionKeyOfObject` )
-     *   - **secretId** which is the given input parameter `secretEncryptionKeyOfObject`
-     */
-    appendEncryptionKeys<T extends EncryptedEntity>(modifiedObject: T, ownerId: string, delegateId: string, secretEncryptionKeyOfObject: string): Promise<{
-        modifiedObject: T;
-        encryptionKeys: {
-            [key: string]: Array<Delegation>;
-        };
-        secretId: string | null;
-    }>;
-    /**
-     * Gets an updated `child` object that will have its SPKs, CFKs, KSs updated to include delegations from delegator HcP with id `ownerId` to delegate HcP with id `delegateId`
-     * The SFKs of `child` are not updated, so this method assumes this is not the initial delegation on the `child` object
-     * The method also performs some deduplication of all types of delegations.
-     * @param parent : the parent object of `child`; will NOT be mutated
-     * @param child : the object that will be mutated and returned
-     * @param ownerId delegator HcP id
-     * @param delegateId delegate HcP id
-     * @param secretDelegationKey  the secret Id used in the child object to generate the SPK
-     * @param secretEncryptionKey  the secret Id used in the child object to generate the EK (Content Encryption Key)
-     * @returns - an updated `child` object that will contain updated SPKs, CFKs, EKs
-     *  */
-    addDelegationsAndEncryptionKeys<T extends EncryptedEntity>(parent: EncryptedParentEntity | null, child: T, ownerId: string, delegateId: string, secretDelegationKey: string | null, secretEncryptionKey: string | null): Promise<T>;
-    /**
-     * Gets the secret IDs (SFKs) inside decrypted SPKs of the given `document`, decrypted by the HcP with the given `hcpartyId` AND by its HcP parents
-     * @param document : the object of which delegations (SPKs) to decrypt
-     * @param hcpartyId : the id of the delegate HcP
-     * @returns - **extractedKeys** array containing secret IDs (SFKs) from decrypted SPKs, from both given HcP and its parents ; can contain duplicates
-     * - **hcpartyId** the given `hcpartyId` OR, if a parent exist, the HcP id of the top parent in the hierarchy  (even if that parent has no delegations)
+     * @deprecated You should use:
+     * - {@link IccPatientXApi.decryptSecretIdsOf} or {@link IccMessageXApi.decryptSecretIdsOf} to get the delegation sfks (now caleld secret ids).
+     * - {@link IccDataOwnerXApi.getCurrentDataOwnerHierarchyIds} to get the full hierarchy for the current data owner (cached). The first element is
+     *   the id of the topmost parent, while the last is the current data owner.
+     * Note that the behaviour of this method has some subtle changes compared to the past:
+     * - throws an error if the provided hcpartyId is not part of the current data owner hierarchy.
+     * - does not provide any guarantees on the ordering of the extracted keys
+     * - deduplicates extracted keys
      */
     extractDelegationsSFKs(document: EncryptedEntity | null, hcpartyId?: string): Promise<{
         extractedKeys: Array<string>;
         hcpartyId?: string;
     }>;
     /**
-     * Gets the secret IDs (SFKs) inside decrypted SPKs of the given `document`, decrypted by the HcP with the given `hcpartyId` AND by its HcP parents
-     * @param document : the object of which delegations (SPKs) to decrypt
-     * @param hcpartyId : the id of the delegate HcP
-     * @returns - **extractedKeys** array containing secret IDs (SFKs) from decrypted SPKs, from both given HcP and its parents ; can contain duplicates
-     * - **hcpartyId** the given `hcpartyId` OR, if a parent exist, the HcP id of the top parent in the hierarchy  (even if that parent has no delegations)
+     * @deprecated (light) You should use:
+     * - {@link IccHelementXApi.decryptPatientIdOf}, {@link IccDocumentXApi.decryptMessageIdOf}, ... to get the crypted foreign keys.
+     * - {@link IccDataOwnerXApi.getCurrentDataOwnerHierarchyIds} to get the full hierarchy for the current data owner (cached). The first element is
+     *   the id of the topmost parent, while the last is the current data owner.
+     * Note that the behaviour of this method has some subtle changes compared to the past:
+     * - throws an error if the provided hcpartyId is not part of the current data owner hierarchy.
+     * - does not provide any guarantees on the ordering of the extracted keys
+     * - deduplicates extracted keys
      */
-    extractSFKsHierarchyFromDelegations(document: EncryptedEntity | null, hcpartyId?: string): Promise<Array<{
-        hcpartyId: string;
-        extractedKeys: Array<string>;
-    }>>;
     extractCryptedFKs(document: EncryptedEntity | null, hcpartyId: string): Promise<{
         extractedKeys: Array<string>;
         hcpartyId: string;
     }>;
+    /**
+     * @deprecated You should use the extended apis methods to encrypt/decrypt entities or their attachments
+     * Note that the behaviour of this method has some subtle changes compared to the past:
+     * - throws an error if the provided hcpartyId is not part of the current data owner hierarchy.
+     * - does not provide any guarantees on the ordering of the extracted keys
+     * - deduplicates extracted keys
+     */
     extractEncryptionsSKs(document: EncryptedEntity, hcpartyId: string): Promise<{
         extractedKeys: Array<string>;
         hcpartyId: string;
     }>;
-    extractDelegationsSFKsAndEncryptionSKs(ety: EncryptedEntity, ownerId: string): Promise<[string[], string[]]>;
-    /**
-     * Get decrypted generic secret IDs (secretIdSPKs, parentIds, secretIdEKs) from generic delegations (SPKs, CFKs, EKs)
-     * 1. Get HealthCareParty from it's Id.
-     * 2. Decrypt the keys of the given HCP.
-     * 3. Decrypt the parent's key if it has parent.
-     * 4. Return the decrypted key corresponding to the Health Care Party.
-     * @param hcpartyId : the id of the delegate HcP (including its parents) for which to decrypt `extractedKeys`
-     * @param objectId : the id of the object/document of which delegations to decrypt ; used just to log to console a message (Cryptographic mistake) in case the object id inside SPK, CFK, EK is different from this one
-     * @param delegations : generic delegations (can be SPKs, CFKs, EKs) for all delegates from where to extract `extractedKeys`
-     * @returns - **extractedKeys** array containing secret IDs from decrypted generic delegations, from both HCP with given `hcpartyId` and its parents; can contain duplicates
-     * - **hcpartyId** the given `hcpartyId` OR, if a parent exist, the HCP id of the top parent in the hierarchy  (even if that parent has no delegations)
-     */
-    extractKeysHierarchyFromDelegationLikes(hcpartyId: string, objectId: string, delegations: {
-        [key: string]: Array<Delegation>;
-    }): Promise<Array<{
-        hcpartyId: string;
-        extractedKeys: Array<string>;
-    }>>;
-    /**
-     * Get decrypted generic secret IDs (secretIdSPKs, parentIds, secretIdEKs) from generic delegations (SPKs, CFKs, EKs)
-     * 1. Get Data Owner (HCP, Patient or Device) from it's Id.
-     * 2. Decrypt the keys of the given data owner.
-     * 3. Decrypt the parent's key if it has parent.
-     * 4. Return the decrypted key corresponding to the Health Care Party.
-     * @param dataOwnerId : the id of the delegate data owner (including its parents) for which to decrypt `extractedKeys`
-     * @param objectId : the id of the object/document of which delegations to decrypt ; used just to log to console a message (Cryptographic mistake) in case the object id inside SPK, CFK, EK is different from this one
-     * @param delegations : generic delegations (can be SPKs, CFKs, EKs) for all delegates from where to extract `extractedKeys`
-     * @returns - **extractedKeys** array containing secret IDs from decrypted generic delegations, from both data owner with given `dataOwnerId` and its parents; can contain duplicates
-     * - **dataOwnerId** the given `dataOwnerId` OR, if a parent exist, the data owner id of the top parent in the hierarchy  (even if that parent has no delegations)
+    /**
+     * @deprecated You should not use this method anymore, depending on what you were passing as {@link delegations} you should replace this method as
+     * explained in {@link extractEncryptionsSKs} (if you were passing encryptionKeys), {@link extractCryptedFKs} (cryptedForeignKeys), or
+     * {@link extractDelegationsSFKs} (delegations).
      */
     extractKeysFromDelegationsForHcpHierarchy(dataOwnerId: string, objectId: string, delegations: {
         [key: string]: Array<Delegation>;
@@ -326,49 +275,54 @@ export declare class IccCryptoXApi {
         hcpartyId: string;
     }>;
     /**
-     * This method covers the use case when a DataOwner found back access to its data, and needs to use the delegations of its delegates instead
-     * of its own ones
-     *
-     * @param dataOwner The current data owner from whom we want to decrypt the aesExchangeKeys
-     * @param delegations The object delegations to decrypt
-     * @param objectId The object to decrypt id
-     * @private
+     * @deprecated you should not need this method anymore: the new API will automatically load on startup all keys available through the key storage
+     * facade and/or recoverable through transfer keys or shamir split. If you were using this method to load a key recovered through other means you
+     * will have to do so in your implementation of CryptoStrategies.
+     * You can convert the private key pkcs8 array to a jwk key using {@link pkcs8ToJwk} then you can extract the full key pair using
+     * {@link keyPairFromPrivateKeyJwk}.
      */
-    private _extractDelegationsKeysUsingDataOwnerDelegateAesExchangeKeys;
-    /**
-     * Gets an array of generic secret IDs decrypted from a list of generic delegations (SPKs, CFKs, EKs) `delegationsArray`
-     * If a particular generic delegation thows an exception when decrypted, the return value for it's secret ID will be 'false' and a message is logged to console
-     * For each one of the delegations in the `delegationsArray`, it tries to decrypt with the decryptedHcPartyKey of the owner of that delegation;
-     *
-     * @param delegationsArray : generic delegations array
-     * @param aesKeys : **key** HcP ids of delegators/owners in the `delegationsArray`, each with its own decryptedHcPartyKey
-     * @param masterId : is the object id to which the generic delegation belongs to
-     * - used only to check whether the object.id matches the one stored in the decrypted generic delegation item
-     * - even if there's no match, the secret ID is kept as a valid result (and a message logged to console)
-     * @returns array of generic secret IDs (secretIdSPK, parentId, secretIdEK)
-     */
-    decryptKeyInDelegationLikes(delegationsArray: Array<Delegation>, aesKeysForDataOwnerId: {
-        [key: string]: {
-            key: CryptoKey;
-            rawKey: string;
-        }[];
-    }, masterId: string): Promise<Array<string>>;
-    getPublicKeyFromPrivateKey(privateKey: JsonWebKey, dataOwner: Patient | Device | HealthcareParty): string;
     loadKeyPairsAsTextInBrowserLocalStorage(healthcarePartyId: string, privateKey: Uint8Array): Promise<void>;
+    /**
+     * @deprecated you should not need this method anymore: the new API will automatically load on startup all keys available through the key storage
+     * facade and/or recoverable through transfer keys or shamir split. If you were using this method to load a key recovered through other means you
+     * will have to do so in your implementation of CryptoStrategies.
+     * You can extract the full key pair using {@link keyPairFromPrivateKeyJwk}.
+     */
     loadKeyPairsAsJwkInBrowserLocalStorage(healthcarePartyId: string, privateKey: JsonWebKey): Promise<void>;
+    /**
+     * @deprecated you should not need this method anymore: the new API will automatically load on startup all keys available through the key storage
+     * facade and/or recoverable through transfer keys or shamir split. If you were using this method to load a key recovered through other means you
+     * will have to do so in your implementation of CryptoStrategies.
+     */
     loadKeyPairsInBrowserLocalStorage(healthcarePartyId: string, file: Blob): Promise<void>;
+    /**
+     * @deprecated keychains are not part of iCure's api: this method will be removed.
+     */
     saveKeychainInBrowserLocalStorage(id: string, keychain: number): void;
+    /**
+     * @deprecated keychains are not part of iCure's api: this method will be removed.
+     */
     saveKeychainInBrowserLocalStorageAsBase64(id: string, keyChainB64: string): void;
+    /**
+     * @deprecated keychains are not part of iCure's api: this method will be removed.
+     */
     saveKeychainValidityDateInBrowserLocalStorage(id: string, date: string): Promise<void>;
     /**
+     * @deprecated keychains are not part of iCure's api: this method will be removed.
+     *
      * Populate the HCP.options dict with an encrypted eHealth certificate and unencryped expiry date.
      * Any potentially unencrypted certificates will be pruned from the HCP.
      * @param hcpId Id of the hcp to modify
      * @returns modified HCP
      */
     saveKeyChainInHCPFromLocalStorage(hcpId: string): Promise<HealthcareParty>;
+    /**
+     * @deprecated keychains are not part of iCure's api: this method will be removed.
+     */
     importKeychainInBrowserFromHCP(hcpId: string): Promise<void>;
     /**
+     * @deprecated e-health certificates and keychains are not part of iCure's api: this method will be removed.
+     *
      * Synchronizes the eHealth certificate from the database into the LocalStorage, returning information on the presence
      * of certificate data in either place.
      *
@@ -380,116 +334,62 @@ export declare class IccCryptoXApi {
         remote: boolean;
         local: boolean;
     }>;
+    /**
+     * @deprecated keychains are not part of iCure's api: this method will be removed.
+     */
     getKeychainInBrowserLocalStorageAsBase64(id: string): Promise<string | undefined>;
+    /**
+     * @deprecated keychains are not part of iCure's api: this method will be removed.
+     */
     getKeychainValidityDateInBrowserLocalStorage(id: string): Promise<string | undefined>;
+    /**
+     * @deprecated keychains are not part of iCure's api: this method will be removed.
+     */
     loadKeychainFromBrowserLocalStorage(id: string): Promise<Uint8Array[] | null>;
     /**
-     * loads the RSA key pair (hcparty) in JWK from local storage, not imported
-     *
-     * @param id  doc id - hcpartyId
-     * @param publicKeyFingerPrint the 32 last characters of public key this private key is associated with
-     * @returns {Object} it is in JWK - not imported
+     * @deprecated you should not need this method anymore to deal with the encryption of iCure entities because everything related to entities
+     * encryption should be done through the entity-specific extended api.
+     * If instead you were using the method for other reasons check {@link getCachedRsaKeyPairForFingerprint} to get an idea of possible replacements.
      */
     loadKeyPairNotImported(id: string, publicKeyFingerPrint?: string): Promise<{
         publicKey: JsonWebKey;
         privateKey: JsonWebKey;
-    }>;
+    } | undefined>;
     /**
-     * Loads and imports the RSA key pair (hcparty) from local storage
-     *
-     * @param id  doc id - hcPartyId
-     * @returns {Promise} -> {CryptoKey} - imported RSA
+     * @deprecated use {@link IccIcureMaintenanceXApi.applyKeyPairUpdate} instead.
      */
-    loadKeyPairImported(id: string): Promise<{
-        publicKey: CryptoKey;
-        privateKey: CryptoKey;
-    }>;
+    giveAccessBackTo(delegateUser: User, ownerId: string, ownerNewPublicKey: string): Promise<DataOwnerWithType>;
     /**
-     * When a user lost his keys, people to whom he shared information may call this method to give access back to him, re-encrypting their common
-     * AES key using the new user public key.
-     *
-     * @param delegateUser Delegate Data Owner User, in charge of giving access back to the person who previously gave him some access
-     * @param ownerId Id of the data owner to which we would like to give access back
-     * @param ownerNewPublicKey New Data Owner Public Key we want to use to re-encrypt previously created AES key
-     *
-     * @return The DataOwner, updated by the delegateUser to add the new encrypted AES Key using the new provided public key
+     * @deprecated You don't need to manually generate exchange keys as they will be automatically created by the api when needed.
+     * Note that this method has some changes compared to previous version:
+     * - The method may return any data owner (including devices)
+     * - The method will throw an exception if the provided ownerId does not match the current data owner
+     */
+    generateKeyForDelegate(ownerId: string, delegateId: string): Promise<DataOwner>;
+    /**
+     * @deprecated replace with {@link IccDataOwnerXApi.getDataOwner}. Note that data owners are not cached anymore.
+     */
+    getDataOwner(ownerId: string, loadIfMissingFromCache?: boolean): Promise<DataOwnerWithType>;
+    /**
+     * @deprecated the crypto api will automatically verify on startup the validity of private keys, but in some cases you may want to verify the
+     * validity of keys recovered in your implementation of {@link CryptoStrategies}: in this case the method has been replaced with
+     * {@link RSA.checkKeyPairValidity}
      */
-    giveAccessBackTo(delegateUser: User, ownerId: string, ownerNewPublicKey: string): Promise<CachedDataOwner>;
-    addNewKeyPairForOwnerId(maintenanceTasksApi: IccMaintenanceTaskXApi, user: User, ownerId: string, generateTransferKey?: boolean, sendMaintenanceTasks?: boolean): Promise<{
-        dataOwner: HealthcareParty | Patient | Device;
-        publicKey: string;
-        privateKey: string;
-    }>;
-    addNewKeyPairForOwner(maintenanceTasksApi: IccMaintenanceTaskXApi, user: User, cdo: CachedDataOwner, generateTransferKey?: boolean, sendMaintenanceTasks?: boolean): Promise<{
-        dataOwner: HealthcareParty | Patient | Device;
-        publicKey: string;
-        privateKey: string;
-    }>;
-    addRawKeyPairForOwnerId(maintenanceTasksApi: IccMaintenanceTaskXApi, user: User, ownerId: string, keypair: {
-        publicKey: string;
-        privateKey: string;
-    }, generateTransferKey?: boolean, sendMaintenanceTasks?: boolean): Promise<{
-        dataOwner: HealthcareParty | Patient | Device;
-        publicKey: string;
-        privateKey: string;
-    }>;
-    addRawKeyPairForOwner(maintenanceTasksApi: IccMaintenanceTaskXApi, user: User, cdo: CachedDataOwner, keypair: {
-        publicKey: string;
-        privateKey: string;
-    }, generateTransferKey?: boolean, sendMaintenanceTasks?: boolean): Promise<{
-        dataOwner: HealthcareParty | Patient | Device;
-        publicKey: string;
-        privateKey: string;
-    }>;
-    addKeyPairForOwner(maintenanceTasksApi: IccMaintenanceTaskXApi, user: User, cdo: CachedDataOwner, keypair: {
-        publicKey: CryptoKey;
-        privateKey: CryptoKey;
-    }, generateTransferKey?: boolean, sendMaintenanceTasks?: boolean): Promise<{
-        dataOwner: HealthcareParty | Patient | Device;
-        publicKey: string;
-        privateKey: string;
-    }>;
-    private _saveDataOwner;
-    private createOrUpdateAesExchangeKeysFor;
-    private createOrUpdateTransferKeysFor;
-    private encryptAesKeyFor;
-    private encryptAesKeyOnlyForProvidedKeys;
-    private retrieveDataOwnerInfoAfterPotentialUpdate;
-    private sendMaintenanceTasks;
-    private createMaintenanceTask;
-    private getDataOwnerHexPublicKeys;
-    private getDataOwnerPublicKeys;
-    generateKeyForDelegate(ownerId: string, delegateId: string): PromiseLike<HealthcareParty | Patient>;
-    getDataOwner(ownerId: string, loadIfMissingFromCache?: boolean): Promise<CachedDataOwner>;
     checkPrivateKeyValidity(dataOwner: HealthcareParty | Patient | Device): Promise<boolean>;
-    private throwDetailedExceptionForInvalidParameter;
+    /**
+     * @deprecated (See {@link extractEncryptionsSKs} for a detailed explanation).
+     */
     getEncryptionDecryptionKeys(dataOwnerId: string, document: EncryptedEntity): Promise<Array<string> | undefined>;
-    dataOwnerCanDecryptPatient(dataOwnerId: string, p: Patient): Promise<boolean>;
+    /**
+     * @deprecated For the encryption/decryption of iCure entities and attachments you should rely solely on the extended apis methods.
+     */
     encryptDecrypt(method: 'encrypt' | 'decrypt', content: Uint8Array | ArrayBuffer, edKey?: string, user?: User, documentObject?: Document): Promise<Uint8Array | Array<any> | any>;
     /**
-     * Store keypair in storage
-     *
-     * @param id
-     * @param keyPair should be JWK
-     *
-     * @deprecated use storage.setItem instead
+     * @deprecated you should not need to interact directly with the storage instance used by the iCure sdk.
      */
     storeKeyPair(id: string, keyPair: {
         publicKey: any;
         privateKey: any;
     }): void;
-    fixAesExchangeKeyEntriesToFingerprints(aesExchangeKeys: {
-        [delegatorPubKey: string]: {
-            [delegateId: string]: {
-                [pubKeyFp: string]: string;
-            };
-        };
-    }): {
-        [delegatorPubKey: string]: {
-            [delegateId: string]: {
-                [pubKeyFp: string]: string;
-            };
-        };
-    };
 }
 export {};