/*!
 * Copyright (c) 2026 Interop Alliance. All rights reserved.
 */
/**
 * The portable keyring lookup: an unlock secret to the account it locates.
 * One derivation, one read of the unlock Space's single resource, one unwrap.
 *
 * Deliberately I/O-only over the remote copy, which is the source of truth: an
 * app's local caching, account-pointer pinning, and client-key-record handling
 * wrap around this rather than living inside it, because those are per-app
 * storage concerns with per-app durability rules.
 */
import type { ServiceDescription } from '@interop/was-client';
import type { UnlockKdf } from './kdf.js';
import type { KeyringRecordContents } from './recordEnvelope.js';
/**
 * Fetches, verifies, and unwraps the keyring record an unlock secret
 * addresses, or
 * resolves `null` when no record exists there (an unknown secret). The derived
 * unlock Space id is returned alongside the contents -- it is already computed,
 * and callers key their local state on it.
 *
 * @param options {object}
 * @param options.secret {string | Uint8Array}   the unlock secret
 * @param options.kdf {UnlockKdf}   the unlock method's parameter set. Required
 *   rather than defaulted: the KDF salt is what keeps two unlock methods from
 *   deriving the same unlock identity, so the caller names its method's set
 *   (`KEYRING_KDF` for a passphrase) and a method that omits it fails to
 *   compile instead of silently reading the passphrase-salted unlock Space.
 * @param options.storageServerUrl {string}   the WAS server origin
 * @param [options.serviceDescription] {ServiceDescription}   the server's
 *   service description a client the caller already holds discovered
 *   (`(await was.service()).description`), so this one skips discovery
 * @returns {Promise<(KeyringRecordContents & { unlockSpaceId: string }) | null>}
 */
export declare function fetchKeyringRecord({ secret, kdf, storageServerUrl, serviceDescription }: {
    secret: string | Uint8Array;
    kdf: UnlockKdf;
    storageServerUrl: string;
    serviceDescription?: ServiceDescription;
}): Promise<(KeyringRecordContents & {
    unlockSpaceId: string;
}) | null>;
//# sourceMappingURL=fetch.d.ts.map