import type { RecordSigner } from '../keyring/record.js';
import { type UserKey } from './userKey.js';
/**
 * Derives the 32-byte Ed25519 seed of the user key's signing half from the
 * key-agreement half's raw secret: HKDF-SHA256 under {@link USER_KEY_SALT},
 * info `signing`. Deterministic and wire-level -- the same user key always
 * yields the same signing key, which is what lets one holder sign a record
 * another holder verifies with nothing server-served in hand.
 *
 * @param options {object}
 * @param options.userKey {UserKey}
 * @returns {Uint8Array}
 */
export declare function userKeySigningSeed({ userKey }: {
    userKey: UserKey;
}): Uint8Array;
/**
 * The user key's record signer: the keyring record's signing seam over the
 * derived Ed25519 half, for an app-side record sealed to the vault KAK
 * (`signRecordFrame`). Its `keyMultibase` is exactly what a reader's
 * allowlist holds, so a writer that already has the signer reads the multibase
 * off it rather than calling {@link userKeySigningKeyMultibase} as well.
 *
 * @param options {object}
 * @param options.userKey {UserKey}
 * @returns {Promise<RecordSigner>}
 */
export declare function userKeyRecordSigner({ userKey }: {
    userKey: UserKey;
}): Promise<RecordSigner>;
/**
 * The public multibase of the user key's signing half: the one key a reader
 * accepts on a record sealed under this user key, handed to
 * `verifyRecordProof` as its allowlist. For a reader alone -- a writer takes
 * the same value off {@link userKeyRecordSigner}'s `keyMultibase`.
 *
 * @param options {object}
 * @param options.userKey {UserKey}
 * @returns {Promise<string>}
 */
export declare function userKeySigningKeyMultibase({ userKey }: {
    userKey: UserKey;
}): Promise<string>;
//# sourceMappingURL=userKeySigning.d.ts.map