/**
 * @fileoverview IdentityValidator — node-side identity validation on content ingestion.
 *
 * Validates content identity before acceptance into the block store:
 * - Real identity: verifies signature matches public key, checks not banned/suspended
 * - Alias identity: looks up alias, verifies active, verifies signature matches alias key, checks owner not banned
 * - Anonymous identity: verifies Membership_Proof present and valid, content-bound
 *
 * @see Requirements 16
 * @see Design: IdentityValidator (Section 8)
 */
import { ECIESService, PlatformID } from '@digitaldefiance/ecies-lib';
import { ContentWithIdentity } from '../interfaces/contentWithIdentity';
import { IBrightTrustDatabase } from '../interfaces/services/brightTrustDatabase';
import { IdentityValidationResult, IIdentityValidator } from '../interfaces/services/identityValidator';
import { IMembershipProofService } from '../interfaces/services/membershipProof';
/**
 * IdentityValidator validates content identity before ingestion into the block store.
 *
 * Dispatches to one of three validation paths based on the creatorId:
 * 1. Anonymous (all-zeroes GuidV4) → verify membership proof
 * 2. Alias (linked via identityRecoveryRecordId) → verify alias active + signature + owner not banned
 * 3. Real identity → verify signature + not banned/suspended
 *
 * @template TID - Platform ID type for frontend/backend DTO compatibility
 */
export declare class IdentityValidator<TID extends PlatformID = Uint8Array> implements IIdentityValidator<TID> {
    private readonly db;
    private readonly eciesService;
    private readonly membershipProofService;
    constructor(db: IBrightTrustDatabase<TID>, eciesService: ECIESService<TID>, membershipProofService: IMembershipProofService<TID>);
    /**
     * Validate content identity before ingestion.
     *
     * Detection logic:
     * - creatorId is all-zeroes → Anonymous mode
     * - identityRecoveryRecordId links to an alias record → Alias mode
     * - Otherwise → Real identity mode
     */
    validateContent(content: ContentWithIdentity<TID>): Promise<IdentityValidationResult>;
    /**
     * Validate real identity content.
     *
     * 1. Look up member by creatorId
     * 2. Verify content signature against member's public key
     * 3. Check member is not banned or suspended
     */
    private validateRealIdentity;
    /**
     * Validate alias identity content.
     *
     * 1. Look up alias by name
     * 2. Verify alias is active
     * 3. Verify content signature against alias public key
     * 4. Check alias owner is not banned/suspended
     */
    private validateAliasIdentity;
    /**
     * Validate anonymous identity content.
     *
     * 1. Verify membership proof is present
     * 2. Verify membership proof is valid against current member set
     * 3. Verify proof is content-bound (uses content hash)
     */
    private validateAnonymous;
    /**
     * Check member status and throw if banned or suspended.
     */
    private checkMemberStatus;
    /**
     * Convert a TID to Uint8Array bytes.
     */
    private toBytes;
}
//# sourceMappingURL=identityValidator.d.ts.map