export { ID_COLLECTION, KEY_MAP_COLLECTION, KEYRING_COLLECTION, KEYRING_RESOURCE, UNLOCK_METHODS_COLLECTION } from './systemCollections.js';
/**
 * The app-neutral display name every wallet passes when provisioning the
 * shared Space (the name is set by whichever wallet happens to create the
 * Space, so a per-app name would brand the account with that one app).
 */
export declare const WALLET_SPACE_NAME = "Wallet Space";
/**
 * The immutable, content-addressed, EDV-encrypted credential replica.
 */
export declare const PRIVATE_CREDENTIALS_COLLECTION = "private-credentials";
/**
 * The plaintext, world-readable copies of publicly shared credentials.
 */
export declare const PUBLIC_CREDENTIALS_COLLECTION = "public-credentials";
/**
 * The append-only, EDV-encrypted wallet activity log.
 */
export declare const WALLET_ACTIVITY_COLLECTION = "wallet-activity";
/**
 * The immutable, content-addressed, EDV-encrypted app-key credential store.
 */
export declare const APP_CONNECTIONS_COLLECTION = "app-connections";
/**
 * What provisioning a wallet Space collection needs: the collection id, the
 * friendly display name both wallets pass as the server-side collection name,
 * and the storage attributes --
 *
 * - `encryption` -- how documents are stored: `'edv'` stores each document as
 *   an EDV envelope, `'plaintext'` stores it verbatim. It says nothing about
 *   where the `encryption` descriptor lives; an `edv` collection is created
 *   bare and declared encrypted by its governing history log's genesis.
 * - `isPublic` -- whether the collection is granted collection-level world read
 *   on the server.
 */
export interface SpaceProvisionSpec {
    collectionId: string;
    name: string;
    encryption: 'edv' | 'plaintext';
    isPublic: boolean;
}
/**
 * A declarative descriptor of a synced wallet Space collection: the
 * provisioning attributes plus the document-identity contract the replication
 * engines need, aligned with `@interop/social-core`'s
 * `CONTACTS_COLLECTION_SPEC` vocabulary --
 *
 * - `idDerivation` -- `'content'` for an append-only, content-addressed log (the
 *   id IS the hash of the stored body) or `'random'` for a mutable head (a
 *   stable id whose body is overwritten).
 * - `mutable` -- whether a document is overwritten in place (`true`) or only
 *   ever appended (`false`).
 * - `shareable` -- whether the collection may be offered on the wallet's share
 *   surface (the `https://w3id.org/byoe#shared-wallet-collection` grant
 *   allowlist and the storage-page share dialog). `shareable: false` keeps a
 *   collection out of sharing while it stays in the encrypted sets (cipher
 *   build, key epochs, the user-key cascade), which are driven by
 *   `encryption: 'edv'`, not by this field.
 */
export interface SpaceCollectionSpec extends SpaceProvisionSpec {
    idDerivation: 'content' | 'random';
    mutable: boolean;
    shareable: boolean;
}
/**
 * The immutable credential replica: each credential stored as an EDV envelope,
 * addressed by the envelope's content hash, never overwritten, never public.
 */
export declare const PRIVATE_CREDENTIALS_COLLECTION_SPEC: SpaceCollectionSpec;
/**
 * The plaintext, world-readable copies of shared credentials, keyed by the
 * credential's content cid (the same id every replica mints, so a share
 * converges), granted collection-level world read on the server. Never
 * shareable: it carries no key-epoch roster, so there is no reader to add.
 */
export declare const PUBLIC_CREDENTIALS_COLLECTION_SPEC: SpaceCollectionSpec;
/**
 * The append-only activity log: each entry stored as an EDV envelope, addressed
 * by content hash, never overwritten, never public. Shared with the web wallet's
 * `wallet-activity` collection, so each replica reads the other's entries.
 */
export declare const WALLET_ACTIVITY_COLLECTION_SPEC: SpaceCollectionSpec;
/**
 * The contacts head collection as it sits in the wallet Space: the identity
 * contract (`collectionId`, `idDerivation`, `mutable`) spread from
 * `@interop/social-core`'s `CONTACTS_COLLECTION_SPEC` (which stays its owner),
 * plus the storage attributes that are wallet-Space layout -- each contact a
 * mutable EDV envelope, never public.
 */
export declare const CONTACTS_SPACE_COLLECTION_SPEC: SpaceCollectionSpec;
/**
 * The contacts history log in the wallet Space: identity contract spread from
 * `@interop/social-core`'s `CONTACTS_HISTORY_COLLECTION_SPEC`, stored as
 * append-only, content-addressed EDV envelopes, never public.
 */
export declare const CONTACTS_HISTORY_SPACE_COLLECTION_SPEC: SpaceCollectionSpec;
/**
 * The app-key credentials behind connected apps, each carrying that app's
 * private seed. Stored as content-addressed EDV envelopes like the credential
 * replica, but in their own collection: keeping them out of
 * `private-credentials` means the credential-wide surfaces (public-link
 * creation, collection shares) can structurally never reach a seed.
 * `shareable: false` is the point of the split.
 */
export declare const APP_CONNECTIONS_COLLECTION_SPEC: SpaceCollectionSpec;
/**
 * The `id` collection's provisioning attributes: plaintext (it holds only
 * world-readable DID artifacts) with a collection-level public-read grant.
 */
export declare const ID_COLLECTION_SPEC: SpaceProvisionSpec;
/**
 * The `key-map` collection's provisioning attributes: plaintext (its resources
 * are wrap-sets and key-id maps, protected by capability, not by an EDV
 * envelope) and capability-only -- never public, exactly so `id` can be
 * world-readable without exposing key material.
 */
export declare const KEY_MAP_COLLECTION_SPEC: SpaceProvisionSpec;
/**
 * The `unlock-methods` collection's provisioning attributes: plaintext (its one
 * resource, `methods.json`, holds non-secret method records -- which unlock
 * methods exist, never the secrets behind them) and capability-only. Read and
 * written directly with the remote as the source of truth (last-write-wins);
 * it gets no local replica and no background replication.
 */
export declare const UNLOCK_METHODS_COLLECTION_SPEC: SpaceProvisionSpec;
/**
 * The synced wallet Space collections, in provision order: the feeds a wallet
 * both provisions and replicates (each gets a local replica and a sync engine).
 */
export declare const WALLET_SPACE_SYNCED_SPECS: SpaceCollectionSpec[];
/**
 * The provisioned-but-not-synced system collections: part of every wallet
 * Space's layout, but no wallet mints a replication feed for them -- their
 * resources (`did.json`, `keys.json`, `user-key.jsonl`, `methods.json`, ...)
 * are read and written directly. `keyring` is deliberately absent: it lives in
 * the separate unlock Space, never in the wallet data Space this roster lays
 * out.
 */
export declare const WALLET_SPACE_SYSTEM_SPECS: SpaceProvisionSpec[];
/**
 * The full wallet Space layout -- every collection the provisioning wallet
 * ensures, synced feeds first. A Space provisioned from this roster is
 * identical no matter which wallet app created it.
 */
export declare const WALLET_SPACE_PROVISION_ROSTER: SpaceProvisionSpec[];
/**
 * The collections the wallet Space encrypts: every provision-roster spec
 * whose `encryption` is `edv`.
 *
 * The one derivation of that set. A collection added to the roster reaches
 * the epoch install and every completion probe over it by that fact alone,
 * rather than by each site remembering to filter the same way.
 *
 * @returns {string[]}
 */
export declare function encryptedWalletCollectionIds(): string[];
/**
 * The world-readable DID document, served as `application/did+json`.
 */
export declare const DID_DOCUMENT_RESOURCE = "did.json";
/**
 * The world-readable did:webvh history log, a raw JSON-Lines string served as
 * `text/jsonl`: one log entry per line, each a full DID-document snapshot in a
 * hash chain. Sibling of `did.json` in the same `id` collection;
 * `did:webvh:<scid>:<host>:space:<spaceId>:id` resolves to
 * `https://<host>/space/<spaceId>/id/did.jsonl`.
 */
export declare const DID_LOG_RESOURCE = "did.jsonl";
/**
 * The (non-public) key-id map: verification method to KMS key id. Lives in the
 * `key-map` collection. The recovery anchor -- written before `did.json` so a
 * torn provisioning resumes from it.
 */
export declare const DID_KEYS_RESOURCE = "keys.json";
/**
 * The resource log governing the user key wrap-set roster, sibling of
 * `keys.json` in the same private `key-map` collection: the hash-linked
 * history of the roster descriptor (the Resource Log Profile), JSON Lines,
 * one signed entry per line. The verified head entry's state is the roster --
 * a `CollectionEncryption` descriptor whose current epoch IS the current user
 * key (the epoch id is the user key's did:key; the wrapped secret is the user
 * key's raw key, wrapped to each enrolled client's key-agreement key). Read
 * directly with a compare-and-swap etag -- never replicated.
 */
export declare const USER_KEY_ROSTER_LOG_RESOURCE = "user-key.jsonl";
/**
 * The governing history log of every encrypted wallet collection: the
 * per-collection encryption descriptor log, at the Collection's own
 * `meta/log` sub-resource.
 *
 * It is a Collection SUB-RESOURCE under the reserved `meta` segment, not a
 * Resource in the Collection: it is absent from listings and from the changes
 * feed, exempt from the envelope rule, covered by any capability whose target
 * covers the Collection, and created and deleted with the Collection. Its
 * body is plaintext JSON Lines, one signed entry per line, and the verified
 * head entry's state IS the collection's `encryption` descriptor -- the
 * server derives the Collection Description's `encryption` member from it, so
 * no client writes that member on a governed collection.
 *
 * The transport is was-client's `resourceLogStore({ collection })`, which
 * reads and writes exactly this sub-resource through the Collection handle.
 */
export declare const COLLECTION_HISTORY_LOG_SUBRESOURCE = "meta/log";
/**
 * The enrolled-client display labels, sibling of `keys.json` and
 * `user-key.jsonl` in the same private `key-map` collection: a plain-JSON map
 * from a client's signing-key multibase to its human-chosen label. Display
 * metadata only -- the did:webvh document carries key material, never labels --
 * and plaintext by the collection's convention: the storage host can read the
 * labels, but it already serves the world-readable log that names every client
 * key, so a label adds only the display name.
 */
export declare const CLIENT_LABELS_RESOURCE = "client-labels.json";
/**
 * The account's unlock-method registry, the single resource of the
 * `unlock-methods` collection: the non-secret records naming which methods can
 * unlock the account (passphrase, passkeys). Read and written directly, remote
 * as the source of truth (last-write-wins) -- never replicated.
 */
export declare const UNLOCK_METHODS_RESOURCE = "methods.json";
//# sourceMappingURL=collections.d.ts.map