import type { IKeyAgreementKey, IKeyResolver } from '@interop/data-integrity-core';
import type { CollectionEncryption } from '@interop/was-client';
import type { AccountPointer, KeyringRecordContents, SignedRecord } from './recordEnvelope.js';
/**
 * The record signer's seam: the signing key's public multibase (which names
 * the key in the proof's `verificationMethod`) and a raw detached-signature
 * hook over it. Structurally the resource log's `ResourceLogSigner`, so one
 * adapter feeds both, deliberately restated here rather than imported -- a
 * record is not a log, and the keyring module keeps its own vocabulary.
 */
export interface RecordSigner {
    keyMultibase: string;
    sign(input: {
        data: Uint8Array;
    }): Promise<Uint8Array>;
}
/**
 * Adapts a signing key agent (the unlock identity's `CapabilityAgent`, or an
 * enrolled client's own key agent) to the record signer seam: the agent's
 * did:key id supplies the public multibase, its signer the raw signature.
 *
 * @param options {object}
 * @param options.keyAgent {object}   a did:key `CapabilityAgent`-shaped agent
 * @returns {RecordSigner}
 */
export declare function recordSignerFromAgent({ keyAgent }: {
    keyAgent: {
        id: string;
        getSigner: () => {
            sign: (input: {
                data: Uint8Array;
            }) => Promise<Uint8Array>;
        };
    };
}): RecordSigner;
/**
 * Adapts a raw 32-byte Ed25519 seed to the record signer seam, for a signing
 * key that is derived on demand rather than held by an agent -- the user key's
 * signing half (`userKeyRecordSigner` in `keys/userKey.ts`) is the one such
 * key today. The seed IS the key material, so the same seed always names the
 * same `keyMultibase`, and a reader that can derive the seed holds the
 * verification prior by construction.
 *
 * @param options {object}
 * @param options.seed {Uint8Array}   the 32-byte Ed25519 seed
 * @returns {Promise<RecordSigner>}
 */
export declare function recordSignerFromSeed({ seed }: {
    seed: Uint8Array;
}): Promise<RecordSigner>;
/**
 * Signs a record's frame members and returns the stored signed record. Shared
 * by the keyring and recovery wrap paths (and available to an app's own record
 * kinds), so one construction produces every signed record: the proof covers
 * `{ version, encryption, wrapped }` plus any record-kind members under JCS
 * canonicalization.
 *
 * @param options {object}
 * @param options.version {number}   the frame version to stamp
 * @param options.encryption {CollectionEncryption}   the record's descriptor
 * @param options.wrapped {unknown}   the sealed envelope
 * @param options.signer {RecordSigner}   the signing key
 * @param [options.members] {object}   additional record-kind frame members the
 *   proof must cover (e.g. the recovery record's `binding`)
 * @returns {Promise<SignedRecord>}
 */
export declare function signRecordFrame({ version, encryption, wrapped, signer, members }: {
    version: number;
    encryption: CollectionEncryption;
    wrapped: unknown;
    signer: RecordSigner;
    members?: Record<string, unknown>;
}): Promise<SignedRecord>;
/**
 * The signing key's public multibase named by a proof's `verificationMethod`:
 * its fragment. The signer emits `did:key:<multibase>#<multibase>`; the DID
 * half is not what authorizes anything -- the multibase IS the key, and the
 * caller's allowlist decides whether it may sign this record.
 *
 * @param options {object}
 * @param options.verificationMethod {string}
 * @param options.label {string}   names the record kind in the refusal
 * @returns {string}
 */
export declare function recordProofKeyMultibase({ verificationMethod, label }: {
    verificationMethod: string;
    label: string;
}): string;
/**
 * Verifies a stored record's proof: the fixed proof shape, the signing key
 * against the caller's allowlist, and the signature over the record's sibling
 * members (everything except `proof`, JCS-canonicalized). Refuses with
 * {@link RecordProofError} in every failing case -- a class of its own, so an
 * app tells "the host forged or tampered with this record" apart from a wrong
 * unlock secret or an unusable version.
 *
 * Standalone as well as internal, because the recovery record's re-minted
 * signer is only knowable after the record is decrypted (see
 * `unwrapRecoveryRecord`).
 *
 * @param options {object}
 * @param options.record {unknown}   the stored record, proof included
 * @param options.allowedKeyMultibases {string | string[]}   the signing keys
 *   this caller accepts, as public multibases or as verification-method ids
 *   whose fragment is one
 * @param [options.label] {string}   names the record kind in refusals;
 *   defaults to the keyring record
 * @returns {Promise<string>}   the verified signing key's public multibase
 */
export declare function verifyRecordProof({ record, allowedKeyMultibases, label }: {
    record: unknown;
    allowedKeyMultibases: string | string[];
    label?: string;
}): Promise<string>;
/**
 * Wraps the account-pointer contents into a keyring record: the controller,
 * email, and pointer (+ timestamp) sealed under a freshly minted record epoch
 * whose key is wrapped to the unlock KAK, then signed by the unlock identity's
 * signing key. Deliberately carries no key material of any kind.
 *
 * The timestamp stays inside the plaintext (the signature covers the
 * ciphertext, so it is covered transitively), so bind times do not leak to a
 * reader of the unlock Space.
 *
 * @param options {object}
 * @param options.controller {string}   the account did:key
 * @param [options.email] {string}   the account email, when known
 * @param [options.pointer] {AccountPointer}   the account pointer (absent on
 *   no-WAS deployments)
 * @param options.keyAgreementKey {IKeyAgreementKey}   the unlock KAK (its
 *   public half is all the wrap uses: sealing needs no key-agreement secret)
 * @param options.signer {RecordSigner}   the unlock identity's signing key
 *   (`recordSignerFromAgent` over the unlock agent)
 * @param [options.createdAt] {string}   the bind timestamp to stamp, as an ISO
 *   string; defaults to now. Supplied by a caller that pins record freshness,
 *   so it knows the stamp without unwrapping the record it just wrote.
 * @returns {Promise<SignedRecord>}
 */
export declare function wrapKeyringRecord({ controller, email, pointer, keyAgreementKey, signer, createdAt }: {
    controller: string;
    email?: string;
    pointer?: AccountPointer;
    keyAgreementKey: IKeyAgreementKey;
    signer: RecordSigner;
    createdAt?: string;
}): Promise<SignedRecord>;
/**
 * Unwraps and validates a keyring record. Verifies the record's proof against
 * the unlock identity's own signing key BEFORE decrypting -- there is no
 * unwrap path that skips it, so a record the storage host substituted is
 * refused ({@link RecordProofError}) rather than decrypted and inspected.
 * Rejects a record whose `version` is not the current one (accounts are
 * re-provisioned, not migrated), and sanity-checks the decrypted plaintext
 * (non-empty controller, well-formed pointer when present, a parseable
 * `createdAt`).
 *
 * @param options {object}
 * @param options.record {unknown}
 * @param options.keyAgreementKey {IKeyAgreementKey}   the unlock KAK
 * @param options.keyResolver {IKeyResolver}
 * @param options.expectedKeyMultibase {string}   the unlock identity's signing
 *   key multibase, derived from the typed secret -- the only key that may have
 *   signed this record
 * @returns {Promise<KeyringRecordContents>}
 */
export declare function unwrapKeyringRecord({ record, keyAgreementKey, keyResolver, expectedKeyMultibase }: {
    record: unknown;
    keyAgreementKey: IKeyAgreementKey;
    keyResolver: IKeyResolver;
    expectedKeyMultibase: string;
}): Promise<KeyringRecordContents>;
//# sourceMappingURL=record.d.ts.map