/**
 * @fileoverview AliasRegistry — manages pseudonymous alias registration,
 * deregistration, and lookup.
 *
 * Aliases map back to a member's real identity through the BrightTrust.
 * The alias-to-identity mapping is sealed via IdentitySealingPipeline.
 *
 * @see Requirements 15
 * @see Design: AliasRegistry (Section 5)
 */
import { ECIESService, HexString, PlatformID } from '@digitaldefiance/ecies-lib';
import { AliasRecord } from '../interfaces/aliasRecord';
import { BrightTrustEpoch } from '../interfaces/brightTrustEpoch';
import { IBrightTrustDatabase } from '../interfaces/services/brightTrustDatabase';
import { IdentitySealingPipeline } from './identitySealingPipeline';
/**
 * AliasRegistry manages pseudonymous alias registration, deregistration,
 * and identity lookup for the BrightTrust system.
 *
 * - Registration validates uniqueness, generates an alias keypair,
 *   seals the alias-to-identity mapping via IdentitySealingPipeline,
 *   and stores the AliasRecord.
 * - Deregistration marks an alias as inactive.
 * - Lookup recovers the real identity behind an alias given sufficient
 *   BrightTrust shares.
 *
 * @template TID - Platform ID type for frontend/backend DTO compatibility
 */
export declare class AliasRegistry<TID extends PlatformID = Uint8Array> {
    private readonly db;
    private readonly identitySealingPipeline;
    private readonly eciesService;
    private readonly currentEpoch;
    constructor(db: IBrightTrustDatabase<TID>, identitySealingPipeline: IdentitySealingPipeline<TID>, eciesService: ECIESService<TID>, currentEpoch: () => Promise<BrightTrustEpoch<TID>>);
    /**
     * Register a new alias for a BrightTrust member.
     *
     * Steps:
     * 1. Validate alias uniqueness via db.isAliasAvailable
     * 2. Generate a new keypair for the alias using eciesService
     * 3. Seal the alias-to-identity mapping via IdentitySealingPipeline
     *    (creates a ContentWithIdentity with the owner's real ID, sealed in Alias mode)
     * 4. Store the AliasRecord with the recovery record ID
     *
     * @param aliasName - The unique pseudonym to register
     * @param ownerMemberId - The real member ID of the alias owner
     * @param ownerPublicKey - The owner's public key (used as creatorId for sealing)
     * @returns The created AliasRecord
     * @throws BrightTrustError with AliasAlreadyTaken if alias name is not available
     * @throws BrightTrustError with IdentitySealingFailed if sealing fails
     */
    registerAlias(aliasName: string, ownerMemberId: HexString, ownerPublicKey: Uint8Array): Promise<AliasRecord<TID>>;
    /**
     * Deregister an alias by marking it as inactive.
     *
     * After deregistration, the alias cannot be used for further content publication.
     *
     * @param aliasName - The alias name to deregister
     * @throws BrightTrustError with AliasNotFound if alias does not exist
     * @throws BrightTrustError with AliasInactive if alias is already inactive
     */
    deregisterAlias(aliasName: string): Promise<void>;
    /**
     * Look up the real identity behind an alias given sufficient BrightTrust shares.
     *
     * Uses the alias's identityRecoveryRecordId to recover the real identity
     * via IdentitySealingPipeline.recoverIdentity().
     *
     * @param aliasName - The alias name to look up
     * @param decryptedShares - Map of member ID to decrypted share string
     * @returns The recovered real identity
     * @throws BrightTrustError with AliasNotFound if alias does not exist
     * @throws BrightTrustError with InsufficientSharesForReconstruction if not enough shares
     */
    lookupAlias(aliasName: string, decryptedShares: Map<HexString, string>): Promise<TID>;
}
//# sourceMappingURL=aliasRegistry.d.ts.map