/*!
 * Copyright (c) 2026 Interop Alliance. All rights reserved.
 */
/**
 * The `@interop/wallet-core/keyring` subpath: the unlock layer -- how an
 * unlock secret (a passphrase, a passkey PRF output) locates an account
 * without authorizing anything against it.
 *
 * - `deriveUnlockIdentity` / `unlockIdentityFromSeed` / `KEYRING_KDF` /
 *   `unlockSpaceIdFor` -- the
 *   wire-level unlock derivation (implemented over `@noble/hashes`, so it runs
 *   unchanged where WebCrypto's `deriveBits` is unavailable) and the unlock
 *   Space addressing convention.
 * - `wrapKeyringRecord` / `unwrapKeyringRecord` -- the
 *   `{ version, encryption, wrapped, proof }` account-pointer record codec.
 * - `recordSignerFromAgent` / `recordSignerFromSeed` / `signRecordFrame` /
 *   `verifyRecordProof` / `RecordProofError` -- the record's authenticity
 *   layer: the proof over the frame members by the unlock identity's signing
 *   key, verified before any decryption, so a storage host cannot substitute
 *   a record it sealed itself. The seed adapter serves a signing key that is
 *   derived on demand rather than held by an agent (the user key's Ed25519
 *   half). `RecordProofError` is declared with the envelope, whose frame
 *   validation raises it; the rest live in `record.ts`.
 * - `mintRecordEncryption` / `recordSealCipher` / `recordCipher` /
 *   `recordEnvelopeId` / `parseRecordFrame` / `parseRecordCreatedAt` /
 *   `recordCreatedAtStamp` --
 *   the record-own-epoch envelope construction the codec seals with (the seal
 *   cipher is encrypt-only, so sealing needs no key-agreement secret) plus
 *   the frame and plaintext validation it opens with,
 *   exported so an app's own locally stored records seal and unseal the same
 *   way (under their own cipher context) rather than re-deriving the
 *   construction. These live in `recordEnvelope.ts`, whose runtime imports
 *   are was-client's EDV subpath and the system collections leaf alone.
 * - `ensureUnlockSpace` / `getUnlockKeyring` / `putUnlockKeyring` /
 *   `deleteUnlockSpace` -- the unlock Space's lifecycle and its one resource.
 *   The read, write, and delete each take an optional `capability` (the
 *   management zcap the unlock identity delegated at bind time) for a
 *   ceremony that reaches the Space without its secret; the delete reports a
 *   404 as an outcome rather than deciding it.
 * - `fetchKeyringRecord` -- the composed lookup (derive, read, unwrap); an
 *   app's caching, pinning, and client-key persistence wrap around it.
 *
 * Kept out of the root export: this subpath pulls the capability-agent / ezcap /
 * was-client dependency graph (the same isolation pattern as `./webvh`).
 */
export { deriveUnlockSeed, KEYRING_KDF } from './kdf.js';
export type { UnlockKdf } from './kdf.js';
export { deriveUnlockIdentity, unlockIdentityFromSeed, UNLOCK_HANDLE, UNLOCK_KEY_NAME, unlockSpaceIdFor } from './unlockIdentity.js';
export type { UnlockIdentity } from './unlockIdentity.js';
export { KEYRING_RECORD_VERSION, mintRecordEncryption, parseRecordCreatedAt, parseRecordFrame, parseRecordPointer, recordCipher, recordCreatedAtStamp, recordEnvelopeId, RecordProofError, recordSealCipher } from './recordEnvelope.js';
export type { AccountPointer, KeyringRecordContents, RecordProof, SignedRecord } from './recordEnvelope.js';
export { recordProofKeyMultibase, recordSignerFromAgent, recordSignerFromSeed, signRecordFrame, unwrapKeyringRecord, verifyRecordProof, wrapKeyringRecord } from './record.js';
export type { RecordSigner } from './record.js';
export { deleteUnlockSpace, ensureUnlockSpace, getUnlockKeyring, putUnlockKeyring, UNLOCK_SPACE_NAME, UNLOCK_SPACE_TYPE } from './unlockSpace.js';
export { fetchKeyringRecord } from './fetch.js';
//# sourceMappingURL=index.d.ts.map