/*!
 * Copyright (c) 2026 Interop Alliance. All rights reserved.
 */
/**
 * ZCap signing under the account's did:webvh identity. After controller
 * promotion the data Space's controller is the did:webvh DID, whose document
 * carries a verification method per enrolled client -- so invocations and
 * delegations must be signed with a keyId of the form
 * `<did:webvh>#<publicKeyMultibase>` (this client's Ed25519 key, published
 * under `capabilityInvocation` / `capabilityDelegation`). The key material
 * is unchanged -- the client's own Ed25519 pair -- only the keyId names the
 * verification method in the did:webvh document instead of the did:key one.
 */
import type { ZcapClient } from '@interop/ezcap';
import type { ISigner } from '@interop/data-integrity-core';
/**
 * The minimal shape of a signing key agent this module operates on -- what
 * `@interop/capability-agent`'s `CapabilityAgent` (and therefore the `keyAgent`
 * of `agentsFromSeed`) already provides: a did:key id, a signer, and the
 * underlying Ed25519 verification key descriptor the X25519 key-agreement twin
 * derives from.
 */
export interface ICapabilityAgent {
    id: string;
    handle: string;
    getSigner: () => ISigner;
    getVerificationKeyPair: () => {
        type: string;
        controller: string;
        publicKeyMultibase: string;
        privateKeyMultibase?: string;
    };
}
/**
 * The client's Ed25519 public key multibase (`z6Mk...`), read out of its
 * did:key id (`did:key:<publicKeyMultibase>`).
 *
 * @param options {object}
 * @param options.keyAgent {ICapabilityAgent}
 * @returns {string}
 */
export declare function clientSigningKeyMultibase({ keyAgent }: {
    keyAgent: ICapabilityAgent;
}): string;
/**
 * A signer over the client's Ed25519 key whose id names this client's
 * verification method in the did:webvh document
 * (`<did:webvh>#<publicKeyMultibase>`). The underlying signer's `sign` is
 * bound rather than spread, so a prototype-hosted method survives.
 *
 * @param options {object}
 * @param options.keyAgent {ICapabilityAgent}
 * @param options.did {string}   the account's did:webvh DID
 * @returns {object}   an ISigner-shaped `{ id, type, sign }`
 */
export declare function webvhSigner({ keyAgent, did }: {
    keyAgent: ICapabilityAgent;
    did: string;
}): {
    id: string;
    type: string;
    sign: (options: {
        data: Uint8Array;
    }) => Promise<Uint8Array>;
};
/**
 * A ZcapClient signing invocations and delegations with this client's key
 * under its did:webvh verification method id -- the client every data-Space
 * request uses once the Space controller is the did:webvh.
 *
 * @param options {object}
 * @param options.keyAgent {ICapabilityAgent}
 * @param options.did {string}   the account's did:webvh DID
 * @returns {ZcapClient}
 */
export declare function webvhZcapClient({ keyAgent, did }: {
    keyAgent: ICapabilityAgent;
    did: string;
}): ZcapClient;
/**
 * A ZcapClient signing with the client's plain did:key identity -- the
 * pre-promotion form, reconstructable from the key agent alone. Used to
 * authorize the promotion itself (the PUT naming the did:webvh is signed by
 * the STORED controller, the did:key) and to heal a promotion that tore.
 *
 * @param options {object}
 * @param options.keyAgent {ICapabilityAgent}
 * @returns {ZcapClient}
 */
export declare function didKeyZcapClient({ keyAgent }: {
    keyAgent: ICapabilityAgent;
}): ZcapClient;
/**
 * A CapabilityAgent-shaped wrapper presenting the client's key under the
 * did:webvh identity, for consumers that take an agent rather than a signer
 * (the WebKMS `KeystoreAgent`, once the keystore's controller is promoted to
 * the did:webvh).
 *
 * @param options {object}
 * @param options.keyAgent {ICapabilityAgent}
 * @param options.did {string}   the account's did:webvh DID
 * @returns {object}   an ICapabilityAgent-shaped wrapper
 */
export declare function webvhCapabilityAgent({ keyAgent, did }: {
    keyAgent: ICapabilityAgent;
    did: string;
}): ICapabilityAgent;
export { isWebvhDid } from './did.js';
//# sourceMappingURL=zcap.d.ts.map