/**
 * Stored owner identity material. Treat as opaque from the consumer's
 * point of view — its internal shape may evolve between SDK versions
 * (e.g. when we migrate to `CryptoKey` references). Custom KeyStore
 * implementations should round-trip the value as-is rather than
 * peeking inside.
 *
 * @public
 */
export interface StoredOwnerKeys {
    /** Schema version. Today: `"0.1.0-hex"`. */
    readonly version: "0.1.0-hex";
    readonly did: string;
    readonly handle: string;
    readonly displayName: string;
    /** Hex-encoded 32-byte Ed25519 seeds — one per sphere. */
    readonly seedsHex: {
        readonly root: string;
        readonly public: string;
        readonly circle: string;
        readonly self: string;
        /**
         * Dedicated `#data` sphere seed (spec/data/02-key-hierarchy.md) — the key
         * that signs ALL data/asset PDS operations (create, edit, manage
         * collections), keeping the root cold. Present on owners created since the
         * `#data` sphere landed. Absent only on legacy owners, which predate it and
         * therefore have no dedicated PDS key — migrate them to `#data` (the backend
         * does this lazily on next custodial sign-in; self-custody/SSO already carry
         * it). Signing PDS ops under any other sphere is a legacy anti-pattern.
         */
        readonly data?: string;
    };
    /** ISO-8601 timestamp of the original save. Informational. */
    readonly savedAt: string;
}
/**
 * Stored delegate session material. Opaque from the consumer's
 * point of view; see {@link StoredOwnerKeys}.
 *
 * @public
 */
export interface StoredDelegateKeys {
    readonly version: "0.1.0-hex";
    /** DID of the subject whose ethos this mandate authorizes. */
    readonly subjectDid: string;
    /** Mandate id — used as the storage key. */
    readonly mandateId: string;
    /** Full §4.2 SignedMandate, stored as opaque JSON. */
    readonly mandate: Record<string, unknown>;
    /** Grantee URN, e.g. `urn:aithos:agent:bob1`. */
    readonly granteeId: string;
    /** Multibase-encoded Ed25519 grantee pubkey, matches `mandate.grantee.pubkey`. */
    readonly granteePubkeyMultibase: string;
    /** Hex-encoded 32-byte delegate Ed25519 seed. */
    readonly delegateSeedHex: string;
    readonly importedAt: string;
}
/**
 * Persistence backend for owner identity material and delegate
 * bundles. Methods are async because an IndexedDB-backed
 * implementation is the default and IDB's API is async — sync stores
 * are still trivial to write (`memoryKeyStore`) by returning
 * pre-resolved promises.
 *
 * Implementations should never throw on missing records: a fresh
 * device returns `null` from `loadOwner` and `[]` from
 * `listDelegates`. They should only throw on hard I/O failures
 * (quota exceeded, schema corruption). The SDK treats throws as
 * "store unavailable, fall through to re-auth".
 *
 * @public
 */
export interface AithosKeyStore {
    loadOwner(): Promise<StoredOwnerKeys | null>;
    saveOwner(owner: StoredOwnerKeys): Promise<void>;
    clearOwner(): Promise<void>;
    listDelegates(): Promise<readonly StoredDelegateKeys[]>;
    loadDelegate(mandateId: string): Promise<StoredDelegateKeys | null>;
    saveDelegate(d: StoredDelegateKeys): Promise<void>;
    removeDelegate(mandateId: string): Promise<void>;
    clearAllDelegates(): Promise<void>;
}
/**
 * In-memory key store. Loses everything on page reload — useful for
 * tests, SSR, ephemeral CLI tools, and any workflow where you want a
 * deliberately short-lived session.
 *
 * @public
 */
export declare function memoryKeyStore(): AithosKeyStore;
/**
 * Default IndexedDB database name used by {@link indexedDbKeyStore}.
 * Apps that want to coexist with other Aithos-aware libs (or scope
 * sessions per-tenant) can pass a custom `dbName`.
 */
export declare const DEFAULT_KEYSTORE_DB_NAME = "aithos-sdk-keys";
interface IndexedDbKeyStoreOptions {
    /** Database name. Defaults to {@link DEFAULT_KEYSTORE_DB_NAME}. */
    readonly dbName?: string;
    /**
     * Inject a non-default IDBFactory — used by tests. Apps should not
     * pass this; the global `indexedDB` is the right choice everywhere
     * else.
     *
     * @internal
     */
    readonly factory?: IDBFactory;
}
/**
 * IndexedDB-backed key store. Default in browser environments —
 * persists across reloads and browser restarts, scoped to the
 * page's origin.
 *
 * Storage shape today:
 *
 *   - object store `owner`     — single record at key `"self"`,
 *                                shape {@link StoredOwnerKeys}
 *   - object store `delegates` — keyPath `mandateId`, shape
 *                                {@link StoredDelegateKeys}
 *
 * Both stores live in DB `aithos-sdk-keys` (configurable via
 * `dbName`) at version 1. Future versions will trigger an upgrade
 * transaction that migrates records into the new shape.
 *
 * @public
 */
export declare function indexedDbKeyStore(opts?: IndexedDbKeyStoreOptions): AithosKeyStore;
/**
 * Pick a sensible default: {@link indexedDbKeyStore} when an IDBFactory
 * is reachable (browser environments), {@link memoryKeyStore} otherwise
 * (Node, edge runtimes — apps running there should pass their own
 * keystore explicitly).
 *
 * @public
 */
export declare function defaultKeyStore(): AithosKeyStore;
export {};
//# sourceMappingURL=key-store.d.ts.map