import { type ParsedRecoveryFile } from "./internal/recovery-file.js";
import { type CmkEnvelope } from "./internal/cmk-wrap.js";
export interface MigrateOptions {
    /** api.aithos.be base URL. Defaults to {@link DEFAULT_API_BASE_URL}. */
    readonly apiBaseUrl?: string;
    /** PDS base URL. Defaults to `https://pds.aithos.be`. Pass the raw
     *  execute-api URL when the vanity host isn't live in your environment. */
    readonly pdsUrl?: string;
    /** Custom fetch (tests / SSR). Defaults to globalThis.fetch. */
    readonly fetch?: typeof fetch;
    /** When true, compute and report planned rekeys but DO NOT write. */
    readonly dryRun?: boolean;
    /**
     * How to onboard a collection onto #data:
     *   - "replace" (default): swap the owner wrap from the legacy sphere to
     *     #data. Use for a clean cutover when NOTHING still reads the collection
     *     under the old key. WARNING: breaks any app still reading under the
     *     legacy key (e.g. linkedone reading under #root).
     *   - "add": KEEP the legacy owner wrap and ADD a second owner wrap sealed to
     *     #data (dual-read). Both the legacy app and a #data client can read the
     *     same data. Requires @aithos/sdk with the multi-wrap owner reader
     *     (this release). Safe, non-destructive — recommended for live accounts.
     */
    readonly mode?: "replace" | "add";
    /**
     * Re-key collections toward a DIFFERENT `#data` key than the one in the
     * recovery file. Used by `rotateEthos`: unwrap with the recovery's (old)
     * sphere seeds, wrap toward this NEW `#data` seed. When omitted, the target
     * is the recovery file's own `#data` seed (the normal migration case).
     */
    readonly targetDataSeedHex?: string;
    /** Progress callback for CLIs / UIs. */
    readonly onProgress?: (e: MigrateProgress) => void;
}
export type MigrateProgress = {
    phase: "ensure-data-sphere";
    status: "start" | "added" | "already-present";
} | {
    phase: "rekey";
    status: "collection";
    collection: string;
    result: CollectionRekeyStatus;
};
export interface EnsureDataSphereResult {
    readonly did: string;
    /** True when this call added #data (false = already present server-side). */
    readonly added: boolean;
    /** The #data sphere seed (hex). The caller MUST persist this — it's the new
     *  key the account signs/reads data under. Returned even when `added` is
     *  false (it's the same seed that's now published). */
    readonly dataSeedHex: string;
    /** Convenience: the recovery file serialized WITH the #data seed merged in. */
    readonly updatedRecoveryFile: string;
}
export type CollectionRekeyStatus = "rekeyed" | "data-wrap-added" | "already-data" | "planned" | "skipped-no-owner-wrap" | "unwrap-failed";
export interface CollectionRekeyEntry {
    readonly name: string;
    readonly urn: string;
    readonly status: CollectionRekeyStatus;
    /** Which seed successfully unwrapped the CMK (auto-discovery result). */
    readonly unwrappedWith?: SphereName;
    /** Count of non-owner (delegate) wraps preserved into the new envelope. */
    readonly delegateWrapsPreserved?: number;
    /** Pre-mutation cmk_envelope, kept so a human can roll back if needed. */
    readonly backupEnvelope?: CmkEnvelope;
}
export interface RekeyReport {
    readonly did: string;
    readonly dryRun: boolean;
    readonly collections: readonly CollectionRekeyEntry[];
}
export interface FullMigrationResult {
    readonly ensure: EnsureDataSphereResult;
    readonly rekey: RekeyReport;
    /** Recovery file with the #data seed — persist this for the user. */
    readonly updatedRecoveryFile: string;
}
type SphereName = "data" | "data-old" | "self" | "circle" | "public" | "root";
/**
 * Idempotently add the `#data` sphere to a (possibly legacy) identity and
 * re-publish its did.json. Accepts either a parsed recovery file or the raw
 * recovery JSON text.
 */
export declare function ensureDataSphere(owner: ParsedRecoveryFile | string, opts?: MigrateOptions): Promise<EnsureDataSphereResult>;
/**
 * Re-wrap every collection's CMK from its legacy sphere to the owner's `#data`
 * key. Idempotent: collections already readable under `#data` are skipped.
 * Requires that the recovery file carries a `#data` seed (run
 * {@link ensureDataSphere} first, or pass {@link FullMigrationResult}).
 */
export declare function rekeyLegacyCollections(owner: ParsedRecoveryFile | string, opts?: MigrateOptions): Promise<RekeyReport>;
/**
 * Dual-read onboarding: KEEP each collection's legacy owner wrap and ADD a
 * second owner wrap sealed to #data, so the existing app (reading under the
 * legacy key) AND a #data client both decrypt the same data. Non-destructive.
 * Thin wrapper over {@link rekeyLegacyCollections} with `mode: "add"`.
 */
export declare function addDataSphereWrap(owner: ParsedRecoveryFile | string, opts?: MigrateOptions): Promise<RekeyReport>;
/**
 * Run the full migration: ensureDataSphere then rekeyLegacyCollections.
 * Returns the updated recovery file (with the #data seed) — persist it.
 */
export declare function migrateLegacyEthosToDataSphere(recoveryText: string, opts?: MigrateOptions): Promise<FullMigrationResult>;
export {};
//# sourceMappingURL=migrate.d.ts.map