/*!
 * Copyright (c) 2026 Interop Alliance. All rights reserved.
 */
/**
 * The descriptor store over a Space's user key wrap-set roster -- since the
 * roster became log-governed, over its resource log (`key-map/user-key.jsonl`).
 * Standalone rather than a method on a wallet's remote-store class, because the
 * login-time direct read checks the roster BEFORE any storage client (or
 * cipher) is built: it takes the bare signing client instead of a store
 * instance.
 *
 * The log resource is addressed through {@link plaintextCollection}, whose
 * override keeps an absent roster a 404 rather than an encryption error and
 * leaves the log's compare-and-swap append guard intact.
 */
import { type IZcap, type ServiceDescription } from '@interop/was-client';
import type { ZcapClient } from '@interop/ezcap';
import { type ResourceLogPinStore, type ResourceLogSigner } from '@interop/vh-resource-log';
import type { WebvhResourceLogController } from '../resourceLog/index.js';
import { type SealableEncryptionDescriptorStore } from './rosterLogStore.js';
/**
 * The pin-slot key for a Space's user key roster log
 * (`key-map/user-key.jsonl`) -- what a caller keying its own
 * {@link ResourceLogPinStore} names the roster's pin by.
 *
 * @param options {object}
 * @param options.spaceId {string}   the data Space id
 * @returns {string}
 */
export declare function userKeyRosterPinId({ spaceId }: {
    spaceId: string;
}): string;
/**
 * Builds the log-governed descriptor store over the user key roster in a
 * data Space: reads resolve to the verified head of
 * `key-map/user-key.jsonl`, writes append to it.
 *
 * @param options {object}
 * @param options.storageServerUrl {string}
 * @param options.zcapClient {ZcapClient}   the session's root signing client
 * @param options.spaceId {string}   the data Space id
 * @param options.resolveController {function}
 *   `() => Promise<WebvhResourceLogController>` -- the caller's currently
 *   verified controller view (`webvhResourceLogController` over a
 *   `verifyAccountLog` result), resolved per operation so post-edit writers
 *   anchor at the head they just verified
 * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
 *   pin for the roster log
 * @param options.signer {ResourceLogSigner}   this client's enrolled signing
 *   key ({@link userKeyRosterLogSigner})
 * @param [options.capability] {IZcap}   an invocation capability attached to
 *   every roster request (a delegated Space-subtree zcap -- the transient
 *   session's generation delegation); absent, requests invoke the root
 *   capability as before
 * @param [options.serviceDescription] {ServiceDescription}   the server's
 *   service description a client the caller already holds discovered
 *   (`(await was.service()).description`), so this one skips discovery
 * @returns {SealableEncryptionDescriptorStore}
 */
export declare function userKeyRosterDescriptorStore({ storageServerUrl, zcapClient, spaceId, resolveController, pinStore, signer, capability, serviceDescription }: {
    storageServerUrl: string;
    zcapClient: ZcapClient;
    spaceId: string;
    resolveController: () => Promise<WebvhResourceLogController>;
    pinStore: ResourceLogPinStore;
    signer: ResourceLogSigner;
    capability?: IZcap;
    serviceDescription?: ServiceDescription;
}): SealableEncryptionDescriptorStore;
//# sourceMappingURL=rosterStore.d.ts.map