/** Raw 32-byte seeds for a rotation. `root` is unchanged; the rest are new. */
export interface RotationSeeds {
    readonly root: Uint8Array;
    readonly public: Uint8Array;
    readonly circle: Uint8Array;
    readonly self: Uint8Array;
    /** Optional dedicated #data sphere (added if present). */
    readonly data?: Uint8Array;
}
interface VerificationMethodLike {
    id: string;
    type: "Ed25519VerificationKey2020" | "X25519KeyAgreementKey2020";
    controller: string;
    publicKeyMultibase: string;
}
/** Minimal structural view of a did.json (browser-safe; no node import). */
export interface DidDocumentLike {
    "@context": readonly string[];
    id: string;
    verificationMethod: readonly VerificationMethodLike[];
    keyAgreement?: readonly VerificationMethodLike[];
    aithos: {
        version: "0.1.0";
        display_name?: string;
        created_at: string;
        rotated: readonly unknown[];
    };
    proof?: unknown;
}
/**
 * Build + sign a rotated did.json. The result rotates every Ethos sphere whose
 * seed differs from the previously-published key, appends one `rotated[]` entry
 * per changed sphere (preserving prior history), carries / adds `#data`, and is
 * signed by `#root`. Ready to POST via `aithos.rotate_sphere_key`.
 *
 * @param seeds        the post-rotation seeds (same root, new sphere seeds).
 * @param previousDoc  the currently-published did.json (old pubkeys + history).
 * @param displayName  display name to carry on the doc.
 * @param reason       audit reason recorded on each new rotated entry.
 */
export declare function buildSignedRotatedDidDocument(seeds: RotationSeeds, previousDoc: DidDocumentLike, displayName: string, reason?: string): DidDocumentLike;
import { type RekeyReport } from "./migrate.js";
import { type ParsedRecoveryFile } from "./internal/recovery-file.js";
export interface RotateEthosOptions {
    /** api.aithos.be base URL. Default {@link DEFAULT_API_BASE_URL}. NOTE: the
     *  Ethos-zone recopy uses @aithos/protocol-client's ambient endpoint
     *  (api.aithos.be); a non-default apiBaseUrl only redirects the did.json
     *  rotation, not the zone publish — keep them aligned (prod) for now. */
    readonly apiBaseUrl?: string;
    /** PDS base URL for the collection re-key. Default `https://pds.aithos.be`. */
    readonly pdsUrl?: string;
    readonly fetch?: typeof fetch;
    /** Audit reason recorded in rotated[]. */
    readonly reason?: string;
    /**
     * Skip the Ethos circle/self zone recopy (the live, protocol-client-RPC part).
     * Used by hermetic tests and by data-only accounts. WARNING: with real
     * circle/self content, skipping while rotating the sphere keys would orphan
     * that content — rotateEthos refuses to rotate the Ethos spheres when an
     * edition exists and zones are skipped (unless `force`).
     */
    readonly skipZones?: boolean;
    /** Override the safety refusal above. */
    readonly force?: boolean;
    /**
     * Migrate a non-v0.4 subject to v0.4 as part of this rotation. Default `true`.
     * The migration is authored UNDER THE OLD KEYS (a height N+1 v0.4 edition sealed
     * to the current sphere keys) BEFORE `rotate_sphere_key`; the rotation then
     * re-seals those zone keys to the NEW keys. Set `false` to preserve the legacy
     * format-preserving behaviour (v0.3 stays v0.3).
     */
    readonly migrateToV04?: boolean;
    readonly onProgress?: (msg: string) => void;
}
export interface RotateEthosResult {
    readonly did: string;
    /** Ethos spheres whose key changed (always public/circle/self here). */
    readonly rotatedSpheres: readonly string[];
    /** Whether a fresh edition was republished (zones re-sealed under new keys). */
    readonly editionRepublished: boolean;
    /** Whether a v0.x→v0.4 migration was performed during this rotation. */
    readonly migratedToV04: boolean;
    /** Whether the account had an Ethos edition at all. */
    readonly hadEdition: boolean;
    /** Collection re-key report (dual #data wraps toward the NEW #data). */
    readonly collections: RekeyReport;
    /** New recovery file (ALL new sphere seeds + new #data). PERSIST THIS. */
    readonly updatedRecoveryFile: string;
}
/**
 * Fully rotate an Ethos: new public/circle/self/#data keys (root unchanged),
 * re-encrypt the Ethos zones under the new keys (fresh edition), and dual-wrap
 * every data collection toward the new #data. Entirely client-side; uses only
 * existing API primitives (rotate_sphere_key, publish_ethos_edition via the
 * protocol-client editor, rotate_cmk). Returns a new recovery file — persist it.
 *
 * Option (a) semantics: the new head edition (carrying all current content) is
 * fully verifiable under the new keys; pre-rotation edition snapshots are not
 * re-verifiable against the rotated did.json (rotated[] retains the old keys so
 * a rotated[]-aware verifier can be added later without re-rotating).
 */
export declare function rotateEthos(recovery: ParsedRecoveryFile | string, opts?: RotateEthosOptions): Promise<RotateEthosResult>;
export {};
//# sourceMappingURL=rotate.d.ts.map